paulk-asert opened a new pull request, #2896: URL: https://github.com/apache/groovy/pull/2896
…by default A failing groovlet sent the script path, exception message and top stack frame to the client in the 500 response body -- the same detail already written to the servlet and application logs. That discloses internals to callers, and as the response is text/html with a request-derived script path, it is also a reflected-content risk where the container does not escape the sendError message. The client now receives a generic 500 by default; the full detail still goes to the logs. A protected isVerboseErrors() hook, defaulting to the groovy.servlet.verbose.errors system property, restores the detailed responses for debugging (override it, or set -Dgroovy.servlet.verbose.errors=true). Documented in THREAT_MODEL.md section 5a, with a regression test. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
