Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disable exception details on default error views

Browse Source 
Prior to this commit, default error responses included the message
from a handled exception. When the exception was a BindException, the
error responses could also include an errors attribute containing the
details of the binding failure. These details could leak information
about the application.

This commit removes the exception message and binding errors detail
from error responses by default, and introduces a
`server.error.include-details` property that can be used to cause
these details to be included in the response.

Fixes gh-20505
This commit is contained in:
Scott Frederick
2020-04-14 09:29:54 -05:00
parent 866147405c
commit 70d4994502
25 changed files with 617 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/env/DevToolsPropertyDefaultsPostProcessor.java vendored
View File

@@ -71,6 +71,7 @@ public class DevToolsPropertyDefaultsPostProcessor implements EnvironmentPostPro
properties.put("spring.resources.chain.cache", "false");
properties.put("spring.template.provider.cache", "false");
properties.put("spring.mvc.log-resolved-exception", "true");
properties.put("server.error.include-details", "ALWAYS");
properties.put("server.error.include-stacktrace", "ALWAYS");
properties.put("server.servlet.jsp.init-parameters.development", "true");
properties.put("spring.reactor.debug", "true");

6
spring-boot-project/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/env/DevToolPropertiesIntegrationTests.java vendored
View File

@@ -106,8 +106,10 @@ class DevToolPropertiesIntegrationTests {
application.setWebApplicationType(WebApplicationType.NONE);
this.context = getContext(application::run);
ConfigurableEnvironment environment = this.context.getEnvironment();
String property = environment.getProperty("server.error.include-stacktrace");
assertThat(property).isEqualTo(ErrorProperties.IncludeStacktrace.ALWAYS.toString());
String includeStackTrace = environment.getProperty("server.error.include-stacktrace");
assertThat(includeStackTrace).isEqualTo(ErrorProperties.IncludeStacktrace.ALWAYS.toString());
String includeDetails = environment.getProperty("server.error.include-details");
assertThat(includeDetails).isEqualTo(ErrorProperties.IncludeDetails.ALWAYS.toString());
}
protected ConfigurableApplicationContext getContext(Supplier<ConfigurableApplicationContext> supplier)