api: exclude clickhouse stacktraces from API outputs

ooni / backend

Everything related to OONI backend infrastructure: ooni/api, ooni/pipeline, ooni/sysadmin, collector, bouncers and test-helpers

BSD 3-Clause "New" or "Revised" License

51 stars 29 forks source link

Closed hellais closed 1 year ago

hellais commented 2 years ago

Currently when the API throws an error due to clickhouse it displays the stacktrace of the error.

While it doesn't really contain any sensitive information it's probably still a good idea to remove it.

This was identified as part of a security audit (OON-01-005 WP4) and was classified as info level severity.

hellais commented 1 year ago

This has been fixed.