Problem/Motivation

When a subscriber to the integration outbox throws, IntegrationOutbox::safeError() stores the exception message in last_error after one replacement: text shaped like name@host becomes [redacted]. The message is then cut to 255 characters and shown in Drush and the admin UI.

Subscriber errors usually come from an HTTP client, and those messages quote the request. A message such as POST https://host/hook?token=…&email=user%40example.com resulted in a 401 keeps the token, the host and the mailbox, because the mailbox is URL-encoded and has no @. The stored text is what the module calls sanitized.

Steps to reproduce

  1. Subscribe to the integration event and throw an exception whose message contains a URL with a query string and a URL-encoded mailbox.
  2. Dispatch the outbox.
  3. Read last_error with the outbox Drush command: the query string and the encoded mailbox are there.

Found by reading 1.x.

Proposed resolution

  • Store a bounded description that cannot carry request data: the exception class, the HTTP status when the exception exposes one, and a fixed reason code. Drop the free-text message, or keep it only after removing URLs, query strings, and encoded and plain mailboxes.
  • Apply the same treatment to the log line for a delivery failure.
  • Add an update hook that rewrites existing last_error values through the new sanitizer.

Remaining tasks

  • Kernel tests: a URL with a token, an encoded mailbox, a plain mailbox and a bearer header value each leave nothing behind; the status code and exception class survive.

API changes

None. last_error becomes less detailed.

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Active » Fixed

Committed to 1.x; ships in 1.2.0. The outbox no longer keeps any free text. last_error and the delivery-failure log line hold a fixed-format summary: the exception class, an HTTP status when the exception exposes one, and a reason code. The exception message is never read. The status is read without naming an HTTP client class, so no dependency is added. Update 10008 rewrites existing values in batches of 250, with no schema change, and the outbox Drush command applies the same rewrite on read until the update has run. Run drush updatedb. last_error is less detailed than before; log the cause in your subscriber if you need it.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • jmcerda committed 2cffa041 on 1.x 
    Issue #3624451: Store a fixed-format delivery error summary in the...