kardolus commented on code in PR #914:
URL: https://github.com/apache/knox/pull/914#discussion_r1626235321
##########
gateway-server/src/main/java/org/apache/knox/gateway/GatewayServlet.java:
##########
@@ -277,4 +278,34 @@ public Enumeration<String> getInitParameterNames() {
return config.getInitParameterNames();
}
}
+
+ private Exception sanitizeException(Exception e) {
+ if (e == null || e.getMessage() == null) {
+ return e;
+ }
+ if (!isErrorMessageSanitizationEnabled || e.getMessage() == null) {
+ return e;
+ }
+ String sanitizedMessage =
e.getMessage().replaceAll("\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b", "[hidden]");
+ return createNewException(e, sanitizedMessage);
Review Comment:
@moresandeep @pzampino I see the merit in having a dedicated class for
sanitizing and logging, which can offer a more maintainable approach moving
forward.
However, I have some concerns regarding potential breaking changes.
Specifically, I'm not certain if there are users who might be utilizing
`GatewayServlet` as if it were a library. If that's the case, changing the
exception signature could lead to breaking changes for them. This is because,
by introducing a new `SanitizedKnoxException`, we would be altering the types
of exceptions that upstream code is expected to catch. Currently, throwing back
the same exception type ensures backward compatibility and constitutes a
non-breaking change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
