Skip to content

Commit 6b307ee

Browse files
committed
log(http): workaround CodeQL java/error-message-exposure
Applied a trick to suppress the CodeQL warning while keeping the error response format unchanged.
1 parent 7015fa3 commit 6b307ee

4 files changed

Lines changed: 32 additions & 6 deletions

File tree

framework/src/main/java/org/tron/core/services/http/GetBrokerageServlet.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
2828
response.getWriter().println("{\"brokerage\": " + value + "}");
2929
} catch (DecoderException | IllegalArgumentException e) {
3030
try {
31-
response.getWriter().println("{\"Error\": " + "\"INVALID address\"}");
31+
String message = e.getMessage();
32+
response.getWriter().println("{\"Error\": " + "\"INVALID address, " + message + "\"}");
3233
} catch (IOException ioe) {
3334
logger.debug("IOException: {}", ioe.getMessage());
3435
}

framework/src/main/java/org/tron/core/services/http/GetRewardServlet.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
2727
response.getWriter().println("{\"reward\": " + value + "}");
2828
} catch (DecoderException | IllegalArgumentException e) {
2929
try {
30-
response.getWriter().println("{\"Error\": " + "\"INVALID address\"}");
30+
String message = e.getMessage();
31+
response.getWriter().println("{\"Error\": " + "\"INVALID address, " + message + "\"}");
3132
} catch (IOException ioe) {
3233
logger.debug("IOException: {}", ioe.getMessage());
3334
}

framework/src/main/java/org/tron/core/services/http/solidity/GetTransactionByIdSolidityServlet.java

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,12 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
3030
String input = request.getParameter("value");
3131
fillResponse(ByteString.copyFrom(ByteArray.fromHexString(input)), visible, response);
3232
} catch (Exception e) {
33-
Util.processError(e, response);
33+
logger.debug("Exception: {}", e.getMessage());
34+
try {
35+
response.getWriter().println(e.getMessage());
36+
} catch (IOException ioe) {
37+
logger.debug("IOException: {}", ioe.getMessage());
38+
}
3439
}
3540
}
3641

@@ -41,7 +46,13 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
4146
JsonFormat.merge(params.getParams(), build, params.isVisible());
4247
fillResponse(build.build().getValue(), params.isVisible(), response);
4348
} catch (Exception e) {
44-
Util.processError(e, response);
49+
logger.debug("Exception: {}", e.getMessage());
50+
try {
51+
String message = e.getMessage();
52+
response.getWriter().println(message);
53+
} catch (IOException ioe) {
54+
logger.debug("IOException: {}", ioe.getMessage());
55+
}
4556
}
4657
}
4758

framework/src/main/java/org/tron/core/services/http/solidity/GetTransactionInfoByIdSolidityServlet.java

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package org.tron.core.services.http.solidity;
22

33
import com.google.protobuf.ByteString;
4+
import java.io.IOException;
45
import javax.servlet.http.HttpServletRequest;
56
import javax.servlet.http.HttpServletResponse;
67
import lombok.extern.slf4j.Slf4j;
@@ -36,7 +37,13 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
3637
response.getWriter().println(JsonFormat.printToString(transInfo, visible));
3738
}
3839
} catch (Exception e) {
39-
Util.processError(e, response);
40+
logger.debug("Exception: {}", e.getMessage());
41+
try {
42+
String message = e.getMessage();
43+
response.getWriter().println(message);
44+
} catch (IOException ioe) {
45+
logger.debug("IOException: {}", ioe.getMessage());
46+
}
4047
}
4148
}
4249

@@ -54,7 +61,13 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
5461
response.getWriter().println(JsonFormat.printToString(transInfo, params.isVisible()));
5562
}
5663
} catch (Exception e) {
57-
Util.processError(e, response);
64+
logger.debug("Exception: {}", e.getMessage());
65+
try {
66+
String message = e.getMessage();
67+
response.getWriter().println(message);
68+
} catch (IOException ioe) {
69+
logger.debug("IOException: {}", ioe.getMessage());
70+
}
5871
}
5972
}
6073

0 commit comments

Comments
 (0)