search

etf-validator / etf-webapp

:earth_africa: :mag: ETF is an open source testing framework for spatial data and services
https://www.etf-validator.net
European Union Public License 1.2
19 stars 19 forks source link

Security patch for hiding stacktrace #221

Closed carlospzurita closed 2 years ago

carlospzurita commented 3 years ago

This patch removes all stacktrace information from error messages making use of the new configuration parameter ETF_SHOW_SENSITIVEINFORMATION. We use the value of this parameter in all instances of errors that we found relevant for any API request that goes through the controllers and API classes

We also modified the exception classes

We may need to refactor these changes, but we would like to have your feedback on what lines are redundant.

carlospzurita commented 3 years ago

We see that there are still required checks to be performed on the PR, but we can't see if they are scheduled to be executed or if there is some error on the execution. Is there anything else that needs to be done.