{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/issues/971","repository_url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler","labels_url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/issues/971/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/issues/971/comments","events_url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/issues/971/events","html_url":"https://github.com/strongloop/loopback-datasource-juggler/issues/971","id":159464833,"number":971,"title":"Exposure of information","user":{"login":"daankets","id":2279985,"avatar_url":"https://avatars.githubusercontent.com/u/2279985?v=3","gravatar_id":"","url":"https://api.github.com/users/daankets","html_url":"https://github.com/daankets","followers_url":"https://api.github.com/users/daankets/followers","following_url":"https://api.github.com/users/daankets/following{/other_user}","gists_url":"https://api.github.com/users/daankets/gists{/gist_id}","starred_url":"https://api.github.com/users/daankets/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daankets/subscriptions","organizations_url":"https://api.github.com/users/daankets/orgs","repos_url":"https://api.github.com/users/daankets/repos","events_url":"https://api.github.com/users/daankets/events{/privacy}","received_events_url":"https://api.github.com/users/daankets/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/labels/triage","name":"triage","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"Amir-61","id":10672146,"avatar_url":"https://avatars.githubusercontent.com/u/10672146?v=3","gravatar_id":"","url":"https://api.github.com/users/Amir-61","html_url":"https://github.com/Amir-61","followers_url":"https://api.github.com/users/Amir-61/followers","following_url":"https://api.github.com/users/Amir-61/following{/other_user}","gists_url":"https://api.github.com/users/Amir-61/gists{/gist_id}","starred_url":"https://api.github.com/users/Amir-61/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amir-61/subscriptions","organizations_url":"https://api.github.com/users/Amir-61/orgs","repos_url":"https://api.github.com/users/Amir-61/repos","events_url":"https://api.github.com/users/Amir-61/events{/privacy}","received_events_url":"https://api.github.com/users/Amir-61/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2016-06-09T17:31:19Z","updated_at":"2016-06-14T17:03:58Z","closed_at":null,"body":"Upon certain datasource errors (connector specific), the datasource juggler forwards error details to the calling layer, that should not be exposed. For example, when using mongoDB, and executing <model>.create({...}) with data that violates a unique index, the datasource juggler will forward the data structure that was supposed to be inserted. This way, certain (for example hidden) fields that must never be exposed to the end user are disclosed in the error message to the client:\r\n\r\n**Example**\r\n```javascript\r\n{\r\n  \"error\": {\r\n    \"code\": 11000,\r\n    \"index\": 0,\r\n    \"errmsg\": \"E11000 duplicate key error index: someDb.someColelction.$someIndex dup key: { : \\\"value1\\\", : \\value2\\\" }\",\r\n    \"op\": {\r\n      \"a\": \"value1\",\r\n      \"b\": \"value2\",\r\n      \"status\": \"new\",\r\n      \"hiddenApiClientId\": \"H1rMIXDV\",\r\n      \"hiddenApiSecretKey\": \"5759a60dbad24e4393c8984b\"\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nIn my opinion, such errors must always be logged to the console, and then propagated in a reduced and sanitised form (referring to the id or timestamp of the log entry).\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/issues/comments/225947943","html_url":"https://github.com/strongloop/loopback-datasource-juggler/issues/971#issuecomment-225947943","issue_url":"https://api.github.com/repos/strongloop/loopback-datasource-juggler/issues/971","id":225947943,"user":{"login":"daankets","id":2279985,"avatar_url":"https://avatars.githubusercontent.com/u/2279985?v=3","gravatar_id":"","url":"https://api.github.com/users/daankets","html_url":"https://github.com/daankets","followers_url":"https://api.github.com/users/daankets/followers","following_url":"https://api.github.com/users/daankets/following{/other_user}","gists_url":"https://api.github.com/users/daankets/gists{/gist_id}","starred_url":"https://api.github.com/users/daankets/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daankets/subscriptions","organizations_url":"https://api.github.com/users/daankets/orgs","repos_url":"https://api.github.com/users/daankets/repos","events_url":"https://api.github.com/users/daankets/events{/privacy}","received_events_url":"https://api.github.com/users/daankets/received_events","type":"User","site_admin":false},"created_at":"2016-06-14T17:03:58Z","updated_at":"2016-06-14T17:03:58Z","body":"I have (for now) implemented a global afterRemoteError component that will\ncapture errors that have either status 500 or no status, and that will\n'sanitise' them - and log them to the error log with a reference. The error\nthat is then propagated to the client refers to the log reference.\nOn Tue, 14 Jun 2016 at 18:22, Simon Ho <notifications@github.com> wrote:\n\n> Sounds like we need something like log levels to limit the verbosity of\n> the returned results. It's a feature request, but a very broad one that may\n> not be so actionable (until we get an exhaustive list of which connectors\n> and which methods to fix, etc). @bajtos <https://github.com/bajtos>\n> Thoughts?\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/strongloop/loopback-datasource-juggler/issues/971#issuecomment-225935969>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe/ACLKMVZ1qVLVht_NcypUr7_ZNouH2XOqks5qLtVGgaJpZM4IyN7M>\n> .\n>\n\n-- \n*Disclaimer*\nThis message is *confidential* and only intended for the originally \nintended recipient(s). It may also be privileged or otherwise protected by \nwork product immunity or other legal rules. *If you think you have received \nthis message by mistake*, please let us know by e-mail reply and delete it \nfrom your system; you must not copy this message or disclose its contents \nto anyone other than the intended recipients.\n"}}
{"actor":{"display_login":"daankets"}}