Hide technical details in answer but log them

Detailed Description

In 2021, this is the second time that an external company specializing in security is reporting during a pentest a security breach because the REST API response includes technical details. Both Spring Boot applications are using the problem-spring-web-starter module with no particular configuration.

Context

In our GET API, a wrong date 2021-13-16 (month at 13) is passed as query param. The handleTypeMismatch method of the TypeMismatchAdviceTrait class is invoked. A hacker can guess the technical stack: Java, Spring Framework, Bean Validation and Swagger in the case bellow.

{
  "title": "Bad Request",
  "status": 400,
  "detail": "Failed to convert value of type 'java.lang.String' to required type 'java.time.LocalDate'; nested exception is org.springframework.core.convert.ConversionFailedException: Failed to convert from type [java.lang.String] to type [@io.swagger.annotations.ApiParam @javax.validation.Valid @org.springframework.web.bind.annotation.RequestParam @org.springframework.format.annotation.DateTimeFormat java.time.LocalDate] for value '2021-13-16'; nested exception is java.lang.IllegalArgumentException: Parse attempt failed for value [2021-13-16]"
}

Possible Implementation

We woud like to have the possibility either to mask class or packages names in the details message that is returned to the client or to use a generic tehnical message.

We have to keep the real technical details in the ERROR log (AdviceTraits::log)

Other way: maybe using an overridable method to build the problem body on demand?

ResponseEntity
        .status(status)
        .headers(headers)
        .contentType(contentType)
        .body(problem))

Your Environment

• Problem version used: 0.26.2
• Spring Boot version : 2.5.2

[arey]

Yes I see that. Thank you for the tipis. So I quickly fixed my issue with the code below (without this we got a nogo in production):

    @Override
    public ProblemBuilder prepare(final Throwable throwable, final StatusType status, final URI type) {
        BusinessException businessException = ExceptionUtils.throwableOfType(throwable, BusinessException.class);
        String detail = (businessException != null) ? businessException.getMessage() : "Technical error";
        return Problem.builder()
            .withType(type)
            .withTitle(status.getReasonPhrase())
            .withStatus(status)
            .withDetail(detail)
            .withCause(Optional.ofNullable(throwable.getCause())
                .filter(cause -> isCausalChainsEnabled())
                .map(this::toProblem)
                .orElse(null));
    }

I don’t know if I am the only developer having this kind of security problem? How do you handle it?

[HJK181]

Hi @arey Thanks for your response. Meanwhile, I debugged a little bit more and I think my problem is caused by @DateTimeFormat(iso = ISO.DATE) annotation of my DTO this causes

org.springframework.core.convert.ConversionFailedException: Failed to conv'
ert from type [java.lang.String] to type [@org.springframework.format.annotation.Da'
teTimeFormat java.time.LocalDate]

This exception gets handled by MethodArgumentNotValidAdviceTrait that created a newConstraintViolationProblem and in that flow the prepare method is not called. Guess I could try to add an @ExceptionHandler for ConversionFailedException and discard the Violation message there.