[
https://issues.apache.org/jira/browse/SOLR-14886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17721758#comment-17721758
]
Jason Gerlowski commented on SOLR-14886:
----------------------------------------
I'm still not necessarily sold on the rationale here (more on this below), but
I appreciate your persistence here and the effort you've taken to keep this
updated. Thanks Isabelle!
On the rationale:
bq. This information could include the names of database tables and columns,
the structure of database queries, method names, configuration details, etc.
[...] the stack trace contains too much information for a response to the
outside world
I understand some of these concerns in proprietary software, but this is
largely open information in an open source project. Forget method names - all
of Solr's code is open to anyone that wants to read it! (And as you noted,
concerns about database tables and columns largely don't apply to Solr.)
"Configuration details" I can understand a little better - a stack trace might
expose which way a particular feature flag is toggled. But in most cases
that'd be evident from the behavior of the API itself, wouldn't it? Will have
to think on it a little more...
> Suppress stack trace in Query response.
> ---------------------------------------
>
> Key: SOLR-14886
> URL: https://issues.apache.org/jira/browse/SOLR-14886
> Project: Solr
> Issue Type: Improvement
> Affects Versions: 8.6.2
> Reporter: Vrinda Davda
> Priority: Minor
> Attachments: SOLR-14886.patch, SOLR-14886.patch
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Currently there is no way to suppress the stack trace in solr response when
> it throws an exception, like when a client sends a badly formed query string,
> or exception with status 500 It sends full stack trace in the response.
> I would propose a configuration for error messages so that the stack trace is
> not visible to avoid any sensitive information in the stack trace.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
