Daniil Kirilyuk created QPID-8620:
-------------------------------------
Summary: [Broker-J] HTTP management plugin can reveal system data
or debug information
Key: QPID-8620
URL: https://issues.apache.org/jira/browse/QPID-8620
Project: Qpid
Issue Type: Improvement
Components: Broker-J
Affects Versions: qpid-java-broker-9.0.0
Reporter: Daniil Kirilyuk
Fix For: qpid-java-broker-9.0.1
The function writeObjectToResponse() in AbstractServlet.java reveals system
data or debug information by calling writeValue(). AbstractServlet, RestServlet
and QueryServlet return error details on exceptions. The error details should
be logged instead and a generic error message should be return in the
HttpServletResponse.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org
For additional commands, e-mail: dev-h...@qpid.apache.org
