Sanitize URL output for HTTP error 400 about micronaut-core HOT 7 CLOSED

yea we should try to avoid user-controlled output in error messages.

from micronaut-core.

go ahead :)

from micronaut-core.

After investigation as an immediate workaround I can try to substitute io.micronaut.http.server.exceptions.URISyntaxHandler. The error itself reported from the guts of JDK java.net.URI.Parser#fail(java.lang.String, int)

from micronaut-core.

@yawkat , what is the recommendation here ?

Option 1 :
Offer a configuration to define whether the exception message should be suppressed or not.
Outcome message is to be suppressed (default) : "message":"Malformed URI"
Outcome message is NOT to be suppressed : "message":"Malformed URI: Illegal character in query at index 2: /?">="

Option 2:
Always suppress the exception message. If someone comes with a requirement that they want the exception to be printed, then implement Option 1.
Outcome : "message":"Malformed URI"

Option 3:
Always encode/escape the content in the exception message before printing to logs. for example < would be encoded as < .
Outcome : "message":"Malformed URI: Illegal character in query at index 2: /?"><tag>="

Option 4:
Offer a configuration to define whether the exception message should be suppressed, encoded or displayed as it is.
Outcome message is to be suppressed : "message":"Malformed URI"
Outcome message is to be encoded (default) : "message":"Malformed URI: Illegal character in query at index 2: /?"><tag>="
Outcome message is NOT to be suppressed : "message":"Malformed URI: Illegal character in query at index 2: /?">="

Personally I prefer Option 4 but Option 2 or Option 1 are also acceptable. What do the maintainers prefer ?

from micronaut-core.

@be-a-bee the path should not be included at all, so option 2. i dont think a config option is necessary. it's also fine if the index is included in the message, but we should avoid the user-supplied input altogether.

from micronaut-core.

Thanks @yawkat for the prompt response. If I may, I will contribute a PR for Option 2.

from micronaut-core.

closed via #10324

from micronaut-core.