apache / apache/polaris

`PolarisDiagnostics` leaks internal information

Open
#770 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
1d 17h
Merged PRs (30d)
137

Description

### Describe the bug

(Related to #759) `PolarisDiagnostics` can expose raw contents of an entity, including internal information.
The contents of those entities then ends in exception messages, which leak all the way down to users via HTTP responses and gets exposed to potentially external systems (logging / tracing).

### To Reproduce

_No response_

### Actual Behavior

_No response_

### Expected Behavior

_No response_

### Additional context

_No response_

### System information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating PolarisDiagnostics and tracing how entity contents enter exception messages and then HTTP responses. Review the related issue #759 for context. Done means internal entity information is no longer exposed through exception messages, HTTP responses, logging, or tracing.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.