Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Stacktrace visible to end-users while performing translog upload #16890

Open
meet-v25 opened this issue Dec 20, 2024 · 1 comment · May be fixed by #16891
Open

[BUG] Stacktrace visible to end-users while performing translog upload #16890

meet-v25 opened this issue Dec 20, 2024 · 1 comment · May be fixed by #16891
Labels
bug Something isn't working Storage:Remote untriaged

Comments

@meet-v25
Copy link

Describe the bug

When uploading translog files to remote store, if any translog file upload fails, the user could see the entire stackstrace of the error occurred. This can also reveal the remote file system's exceptions details.

Root Cause:

For logging, we add all the exceptions as suppressed under a single exception. However, while reporting an error to users, we are throwing the same exception which contains all the suppressed exceptions. This causes the users to be able to see all the exceptions and stacktrace.

Related component

Storage:Remote

To Reproduce

When translog files are being uploaded to remote store, drop any file or any packet to reproduce the issue.

Expected behavior

Details of exceptions and stacktrace about remote filesystems should not be visible to users in a response, since it can reveal sensitive info about remote file-system's implementation.

Additional Details

Plugins
Please list all plugins currently enabled.

Screenshots
If applicable, add screenshots to help explain your problem.

Host/Environment (please complete the following information):

  • OS: [e.g. iOS]
  • Version [e.g. 22]

Additional context
Add any other context about the problem here.

@andrross
Copy link
Member

@meet-v25 Does this still happen if http.detailed_errors.enabled is set to false? I suspect this is not the only place where potentially sensitive data will be present in stack traces, which is why that setting exists to disable including that extra detail in user-facing responses.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Storage:Remote untriaged
Projects
Status: 🆕 New
Development

Successfully merging a pull request may close this issue.

2 participants