DependencyTrack / DependencyTrack/dependency-track
SlackPublisher Error logs secret
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 9h 4m
- Merged PRs (30d)
- 229
Description
### Current Behavior:
When Slack notifications exceed the allowed Rate Limit, the following is logged:
```
10:51:55.724 ERROR [SlackPublisher] An error was encountered publishing notification to Slack
10:51:55.725 ERROR [SlackPublisher] HTTP Status : 429 Too Many Requests
10:51:55.725 ERROR [SlackPublisher] Destination: https://hooks.slack.com/services/XXXXXXXXX/YYYYYYYYY/ZZZZZZZZZZZZZZZZZZZZZZZZ
```
That's not the actual URL. I obfuscated it. DT actually logs the full URL
From [Slack Webhooks Documentation](https://api.slack.com/messaging/webhooks)
> Keep it secret, keep it safe. Your webhook URL contains a secret. Don't share it....
Logging = sharing! A lot of people in my company can view our DT logs.
### Steps to Reproduce:
See #1159
### Expected Behavior:
The logging should be tweaked so that the Slack Notification is uniquely identifiable... but not using the webhook URL.
### Environment:
- Dependency-Track Version: 4.3.1
- Distribution: [ Docker ]
- BOM Format & Version: CycloneDX 1.2
- Database Server: [PostgreSQL ]
- Browser: Firefox
### Additional Details:
Logging this one separately to #1159 as I am hoping that it should be quick and easy to address.
Contributor guide
Research direction
Start by locating the SlackPublisher implementation and inspect the error logging shown in the issue, using #1159 for reproduction context. The change is complete when Slack rate-limit errors remain identifiable without logging the Slack webhook URL or its secret.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100