This is an automated email from the ASF dual-hosted git repository.
josedee pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new ef2c9f5ffa0 [incubator-kie-issues#2361] Fix log forging cwe (#6861)
ef2c9f5ffa0 is described below
commit ef2c9f5ffa0f429cb6a33d771e2ecffe6095b21f
Author: AthiraHari77 <[email protected]>
AuthorDate: Thu Aug 13 22:12:35 2026 +0530
[incubator-kie-issues#2361] Fix log forging cwe (#6861)
* [incubator-kie-issues#2361] fix log forging cwe
* CI Retrigger
---------
Co-authored-by: athira <[email protected]>
---
.../main/java/org/kie/kogito/pmml/AbstractPMMLRestResource.java | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git
a/kogito-drools/kogito-pmml/src/main/java/org/kie/kogito/pmml/AbstractPMMLRestResource.java
b/kogito-drools/kogito-pmml/src/main/java/org/kie/kogito/pmml/AbstractPMMLRestResource.java
index da31c7802de..c8dd7b3ce39 100644
---
a/kogito-drools/kogito-pmml/src/main/java/org/kie/kogito/pmml/AbstractPMMLRestResource.java
+++
b/kogito-drools/kogito-pmml/src/main/java/org/kie/kogito/pmml/AbstractPMMLRestResource.java
@@ -45,7 +45,13 @@ public abstract class AbstractPMMLRestResource {
String errorMessage = String.format("%s: %s",
e.getClass().getName(), sanitizedMessage);
- Logger.getLogger(ErrorHandler.class.getName()).log(Level.SEVERE,
errorMessage, e);
+ // Build a sanitized exception with no cause chain and no reference to
the
+ // original object. The stack trace frames (class/method/file/line
metadata
+ // only — no message text) are copied for debugging. The original
exception e
+ // is never passed to the log sink in any form.
+ Exception sanitized = new Exception(errorMessage);
+ sanitized.setStackTrace(e.getStackTrace());
+ Logger.getLogger(ErrorHandler.class.getName()).log(Level.SEVERE,
errorMessage, sanitized);
return String.format("{\"exception\": \"%s\"}",
e.getClass().getSimpleName());
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
