Community
Participate
Working Groups
Build Identifier: 3.7.0 If an exception happens on the server it will be replaced with and outline exception which is forwarded to the client. Stacktrace and message gets lost which is fine. But: The error code and severity of the exception gets lost too. In my opinion it is no security risk to have this information on client side. So please add this information to the outbound exception. Reproducible: Always
You can simple create (on server side) a subclass of DefaultTransactionDelegate: public class MyTransactionDelegate extends DefaultTransactionDelegate{ ... protected Throwable replaceOutboundException(Throwable t) { your code... } } Then include it in your /process servlet as: public class MyServiceTunnelServlet extends ServiceTunnelServlet{ ... protected ServiceTunnelResponse runServerJobTransactionWithDelegate(ServiceTunnelRequest req, Bundle[] loaderBundles, Version requestMinVersion, boolean debug) throws Exception { return new MyTransactionDelegate(loaderBundles, requestMinVersion, debug).invoke(req); } }
Hi Ivan Your right, it easy to exchange the default behaviour which is great! However, in my opinion the severity is a useful information and no security risk, so why should it be removed as default? Regards Claudio
*** Bug 389485 has been marked as a duplicate of this bug. ***
Reopened because still not fixed.
Created attachment 221032 [details] Patch Patch adds two new constructors to VetoException and makes sure that in DefaultTransactionDelegate, the newly created VetoException has the same error code and severity as the initial one.
Due to the two new constructors for VetoException, a object creation by using new VetoException("message", null /* cause */, errorCode, IProcessingStatus.ERROR) is now ambiguous and new VetoException("message", errorCode, IProcessingStatus.ERROR) should be used instead.
Patch committed.
shipped with scout juno sr1
