DependencyTrack / DependencyTrack/dependency-track

SlackPublisher Error logs secret

Open
#1,160 0 comments 0 reactions 0 assignees View on GitHub
enhancement integration/slack p3
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
9h 4m
Merged PRs (30d)
229

Description

### Current Behavior:

When Slack notifications exceed the allowed Rate Limit, the following is logged:

```
10:51:55.724 ERROR [SlackPublisher] An error was encountered publishing notification to Slack
10:51:55.725 ERROR [SlackPublisher] HTTP Status : 429 Too Many Requests
10:51:55.725 ERROR [SlackPublisher] Destination: https://hooks.slack.com/services/XXXXXXXXX/YYYYYYYYY/ZZZZZZZZZZZZZZZZZZZZZZZZ
```
That's not the actual URL. I obfuscated it. DT actually logs the full URL

From [Slack Webhooks Documentation](https://api.slack.com/messaging/webhooks)

> Keep it secret, keep it safe. Your webhook URL contains a secret. Don't share it....

Logging = sharing! A lot of people in my company can view our DT logs.

### Steps to Reproduce:

See #1159

### Expected Behavior:

The logging should be tweaked so that the Slack Notification is uniquely identifiable... but not using the webhook URL.

### Environment:

- Dependency-Track Version: 4.3.1
- Distribution: [ Docker ]
- BOM Format & Version: CycloneDX 1.2
- Database Server: [PostgreSQL ]
- Browser: Firefox

### Additional Details:

Logging this one separately to #1159 as I am hoping that it should be quick and easy to address.

Contributor guide

Open the contributing guide

Research direction

Start by locating the SlackPublisher implementation and inspect the error logging shown in the issue, using #1159 for reproduction context. The change is complete when Slack rate-limit errors remain identifiable without logging the Slack webhook URL or its secret.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.