Skip to content

Commit b9aaa84

Browse files
parthban-dbparthban-db
committed
Stop logging HTTP response bodies in generated executeHttpCall
Summary: Regenerates utils.ts across all generated packages so the generated executeHttpCall helper no longer logs the HTTP response body at debug level, preventing plaintext secrets from leaking into debug logs. Why: executeHttpCall logged the full decoded response body at debug level with no redaction or opt-in. Endpoints such as getSecret() return the plaintext secret in that body, so any consumer with debug logging enabled would write secrets to their logs. The streaming helper sendAndCheckError already logged only statusCode; this makes executeHttpCall consistent. The Logger interface in sdk-core exposes no level below debug and no body-logging opt-in, so the body is dropped from the default log. This is regenerated output and pairs with the generator change in databricks-eng/universe (openapi/genkit/codegen/sdkjs/utils.go). It contains no hand-written source changes. Behavioral change: executeHttpCall now logs only {statusCode} instead of {statusCode, body}. Divergence from the Go SDK: the Go SDK can log response bodies behind an explicit DebugBytes opt-in (default off); the JS SDK has no equivalent opt-in, so the body is omitted unconditionally. Tested: npm run build (86/86), @databricks/sdk-core tests (357 passing), npm run lint (94/94), npm run typecheck (94/94). Co-authored-by: Isaac
1 parent 4680f01 commit b9aaa84

83 files changed

Lines changed: 249 additions & 332 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎packages/accessmanagement/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/alerts/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/alerts/src/v2/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/apps/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -110,10 +110,9 @@ export async function executeHttpCall(
110110

111111
const body = await readAll(resp.body);
112112

113-
opts.logger.debug('HTTP response', {
114-
statusCode: resp.statusCode,
115-
body: new TextDecoder().decode(body),
116-
});
113+
// Log only statusCode. The body can contain plaintext secrets, e.g.
114+
// getSecret(), so logging it would leak them into debug logs.
115+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
117116

118117
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
119118
if (apiErr !== undefined) {

‎packages/authentication/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/budgetpolicy/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/budgets/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/cleanrooms/src/v1/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -110,10 +110,9 @@ export async function executeHttpCall(
110110

111111
const body = await readAll(resp.body);
112112

113-
opts.logger.debug('HTTP response', {
114-
statusCode: resp.statusCode,
115-
body: new TextDecoder().decode(body),
116-
});
113+
// Log only statusCode. The body can contain plaintext secrets, e.g.
114+
// getSecret(), so logging it would leak them into debug logs.
115+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
117116

118117
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
119118
if (apiErr !== undefined) {

‎packages/clusterlibraries/src/v2/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

‎packages/clusterpolicies/src/v2/utils.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ export async function executeHttpCall(
8686

8787
const body = await readAll(resp.body);
8888

89-
opts.logger.debug('HTTP response', {
90-
statusCode: resp.statusCode,
91-
body: new TextDecoder().decode(body),
92-
});
89+
// Log only statusCode. The body can contain plaintext secrets, e.g.
90+
// getSecret(), so logging it would leak them into debug logs.
91+
opts.logger.debug('HTTP response', {statusCode: resp.statusCode});
9392

9493
const apiErr = ApiError.fromHttpError(resp.statusCode, resp.headers, body);
9594
if (apiErr !== undefined) {

0 commit comments

Comments
 (0)