Don't include stacktraces in REST responses

OWASP best practices recommend user facing error messages should not
contain stack traces or line numbers. The full stack trace should still be available in karaf.log.

Change-Id: Ia8ffed91ecdbf8a1d299c90c33882bbc18d55b50
Signed-off-by: Evan Zeller <evanrzeller@gmail.com>

diff --git a/restconf/restconf-common/src/main/java/org/opendaylight/restconf/common/errors/RestconfDocumentedException.java b/restconf/restconf-common/src/main/java/org/opendaylight/restconf/common/errors/RestconfDocumentedException.java
index 18519d6e9873a0e1964b028bbaa7d1e6d30d9ddc..dd93c534ba1ed1ec626487d4a6dc72549e231aa8 100644 (file)
--- a/restconf/restconf-common/src/main/java/org/opendaylight/restconf/common/errors/RestconfDocumentedException.java
+++ b/restconf/restconf-common/src/main/java/org/opendaylight/restconf/common/errors/RestconfDocumentedException.java
@@ -64,7 +64,7 @@ public class RestconfDocumentedException extends WebApplicationException {
     public RestconfDocumentedException(final String message, final ErrorType errorType, final ErrorTag errorTag,
                                        final Throwable cause) {
         this(cause, new RestconfError(errorType, errorTag, message, null,
-                Throwables.getStackTraceAsString(cause), null));
+                cause.getMessage(), null));
     }
 
     /**
@@ -100,7 +100,7 @@ public class RestconfDocumentedException extends WebApplicationException {
 
     /**
      * Constructs an instance with an error message and exception cause.
-     * The stack trace of the exception is included in the error info.
+     * The underlying exception is included in the error-info.
      *
      * @param message
      *            A string which provides a plain text string describing the error.
@@ -109,7 +109,7 @@ public class RestconfDocumentedException extends WebApplicationException {
      */
     public RestconfDocumentedException(final String message, final Throwable cause) {
         this(cause, new RestconfError(RestconfError.ErrorType.APPLICATION, RestconfError.ErrorTag.OPERATION_FAILED,
-                message, null, Throwables.getStackTraceAsString(cause), null));
+                message, null, cause.getMessage(), null));
     }
 
     /**

diff --git a/restconf/restconf-nb-rfc8040/src/test/java/org/opendaylight/restconf/nb/rfc8040/rests/services/impl/JSONRestconfServiceRfc8040ImplTest.java b/restconf/restconf-nb-rfc8040/src/test/java/org/opendaylight/restconf/nb/rfc8040/rests/services/impl/JSONRestconfServiceRfc8040ImplTest.java
index 348569bd731c7081d328fda5913c5fc3d5376d2c..624828cbb0972dfceba6280f0bd5db59d902308d 100644 (file)
--- a/restconf/restconf-nb-rfc8040/src/test/java/org/opendaylight/restconf/nb/rfc8040/rests/services/impl/JSONRestconfServiceRfc8040ImplTest.java
+++ b/restconf/restconf-nb-rfc8040/src/test/java/org/opendaylight/restconf/nb/rfc8040/rests/services/impl/JSONRestconfServiceRfc8040ImplTest.java
@@ -411,7 +411,7 @@ public class JSONRestconfServiceRfc8040ImplTest {
         final Optional<String> patchResult = this.service.patch(uriPath, payload);
         assertTrue("Patch output is not null", patchResult.isPresent());
         String patch = patchResult.get();
-        assertTrue(patch.contains("TransactionCommitFailedException"));
+        assertTrue(patch.contains("mock"));
     }
 
     @Test