Skip to content

api(CodeQL): fix error message exposure in http response #6449

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kuny0707 merged 1 commit into from
Sep 18, 2025
+29 −6
Merged

api(CodeQL): fix error message exposure in http response #6449

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion framework/src/main/java/org/tron/core/services/http/GetBrokerageServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,8 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
response.getWriter().println("{\"brokerage\": " + value + "}");
} catch (DecoderException | IllegalArgumentException e) {
try {
response.getWriter().println("{\"Error\": " + "\"INVALID address\"}");
response.getWriter()
.println("{\"Error\": " + "\"INVALID address, " + e.getMessage() + "\"}");
} catch (IOException ioe) {
logger.debug("IOException: {}", ioe.getMessage());
}
Expand Down
3 changes: 2 additions & 1 deletion framework/src/main/java/org/tron/core/services/http/GetRewardServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,8 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
response.getWriter().println("{\"reward\": " + value + "}");
} catch (DecoderException | IllegalArgumentException e) {
try {
response.getWriter().println("{\"Error\": " + "\"INVALID address\"}");
response.getWriter()
.println("{\"Error\": " + "\"INVALID address, " + e.getMessage() + "\"}");
} catch (IOException ioe) {
logger.debug("IOException: {}", ioe.getMessage());
}
Expand Down
14 changes: 12 additions & 2 deletions ...src/main/java/org/tron/core/services/http/solidity/GetTransactionByIdSolidityServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,12 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
String input = request.getParameter("value");
fillResponse(ByteString.copyFrom(ByteArray.fromHexString(input)), visible, response);
} catch (Exception e) {
Util.processError(e, response);
logger.debug("Exception: {}", e.getMessage());
try {
response.getWriter().println(e.getMessage());
} catch (IOException ioe) {
logger.debug("IOException: {}", ioe.getMessage());
}
}
}

Expand All @@ -41,7 +46,12 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
JsonFormat.merge(params.getParams(), build, params.isVisible());
fillResponse(build.build().getValue(), params.isVisible(), response);
} catch (Exception e) {
Util.processError(e, response);
logger.debug("Exception: {}", e.getMessage());
try {
response.getWriter().println(e.getMessage());
} catch (IOException ioe) {
logger.debug("IOException: {}", ioe.getMessage());
}
Copy link
Contributor

@317787106 317787106 Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe it's not a good idea to modify the error message and remove Exception for every API. A better solution would be to update the implementation of Util.processError uniformly.

Copy link
Contributor Author

@halibobo1205 halibobo1205 Sep 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@317787106 This is a legacy API; do not modify anything, even the error messages.

Copy link
Contributor

@317787106 317787106 Sep 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Get it

}
}

Expand Down
15 changes: 13 additions & 2 deletions ...main/java/org/tron/core/services/http/solidity/GetTransactionInfoByIdSolidityServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package org.tron.core.services.http.solidity;

import com.google.protobuf.ByteString;
import java.io.IOException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
Expand Down Expand Up @@ -36,7 +37,12 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
response.getWriter().println(JsonFormat.printToString(transInfo, visible));
}
} catch (Exception e) {
Util.processError(e, response);
logger.debug("Exception: {}", e.getMessage());
try {
response.getWriter().println(e.getMessage());
} catch (IOException ioe) {
logger.debug("IOException: {}", ioe.getMessage());
}
}
}

Expand All @@ -54,7 +60,12 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
response.getWriter().println(JsonFormat.printToString(transInfo, params.isVisible()));
}
} catch (Exception e) {
Util.processError(e, response);
logger.debug("Exception: {}", e.getMessage());
try {
response.getWriter().println(e.getMessage());
} catch (IOException ioe) {
logger.debug("IOException: {}", ioe.getMessage());
}
}
}

Expand Down