Homec4science

Reduce the amount of information leaked into stack traces

Authored by epriestley <git@epriestley.com> on Jun 15 2014, 19:51.

Description

Reduce the amount of information leaked into stack traces

Summary:
Via HackerOne. We currently expose the daemon log in the web UI. The utility of doing this is large, but stack traces may occasionally contain too much information.

Instead of printing out function arguments in stack traces, just print out the types. This is at least as useful in most cases, and can't leak anything sensitive.

Also, when possible, canonicalize paths in stack traces relative to a known library. This makes them slightly more readable, and may reduce the number of researchers reporting full path disclosure via HackerOne.

Test Plan:
Ran something like this:

function f() {
  throw new Exception("ABCDEF");
}

f("a", 1, null, false, (object)array(), array(), new PhutilJSON());

...and got this stack trace:

>>> orbital ~/devtools/libphutil $ ./scripts/test/prompt.php
[2014-06-14 19:14:45] EXCEPTION: (Exception) ABCDEF at [<phutil>/scripts/test/prompt.php:8]
  #0 f(string, integer, NULL, boolean, stdClass, array, PhutilJSON) called at [<phutil>/scripts/test/prompt.php:11]

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D9540

Details

Committed
epriestley <git@epriestley.com>Jun 15 2014, 19:51
Pushed
aubortMar 17 2017, 12:03
Parents
rPHUfe71010796fb: Fix phutil_utf8_console_strlen() for combining characters
Branches
Unknown
Tags
Unknown

Event Timeline

epriestley <git@epriestley.com> committed rPHUe57d872cbe61: Reduce the amount of information leaked into stack traces (authored by epriestley <git@epriestley.com>).Jun 15 2014, 19:51