open-telemetry / open-telemetry/opentelemetry-java-instrumentation
PII data can be present in exception messages that are captured
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 1.2k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 228
Description
Reported via technical committee responsible disclosure inbox:
When an exception occurs performing some database interaction, such as a batch update, the OpenTelemetry
Java auto-instrumentation will appropriately sanitize the db.statement attribute, as well as any other
relevant attributes, if any. However, the auto-instrumentation will NOT sanitize any exception messages
that are provided to it, such as a java.sq.BatchUpdateException. This leaves the possibility of PII and
other potential user information being leaked in the generated span.Is it possible to leverage the existing database sanitizers to attempt to sanitize the db exception message
prior to adding the exception message as a span attribute?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the existing database sanitizers and the code that adds captured exception messages to spans. Confirm the behavior with a database exception containing user information; done means the exception message is sanitized before it becomes a span attribute.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100