security - Java: what information in error stack trace do we typically not wish to show users? -


i'm new java , i'm not familiar formatting rules used error stack trace when thrown , subsequently displayed end-user of web application.

my experience oracle database error stack contains internal information, such schema , procedure names , line number(s), which, while useful debugging, prevent user seeing. here's example:

java.sql.sqlexception : ora-20011: error description here ora-07894: @ "name_of_schema.procedure_name", line 121 ora-08932: @ line 10 

the string want display user error description here. can extract string using regex expressions because know (1) string on first line, can extract first line of error stack trace, , (2) string begins error , ends end of line. [note oracle users (i don't want mislead you): above applies when using raise_application_error error string starting error, otherwise text error not there].

my questions java are:

(1) there potentially sensitive wouldn't want users see in error stack? if so, what? example, file paths, server name/ip, etc.

(2) there formatting rules java error stack trace can rely on extract non-sensitive information? or, how others address concern?

update 1:

thanks replies far, they've been helpful. while many people comment use function such getuserfriendlymessage() map errors useful user messages, wonder if expand on mapping. is, common errors (sql, i/o, etc.), "reliable" identifier used search error stack identify type of error happened, , corresponding text string recommend map error message show user? @adarshr's response below start. example,

identified expected   if found in error stack, display friendly msg user -------------------   ---------------------------------------------------------- sqlexception          error occurred accessing database. please contact support @ support@companyname.com. ioexception           connection error(?). please check internet connection. 

assume compile-related errors don't need addressed, rather focus errors end users might experience during normal use. reference, here's list of run-time error messages: http://mindprod.com/jgloss/runerrormessages.html#ioexception

alternatively, possible use first line of stack trace display user? link sort of getting @ in original question above:

http://www3.ntu.edu.sg/home/ehchua/programming/howto/errormessages.html

for example, if identifier exception used, 1 extract text comes between exception , end of first line. don't know if can rely on exception being there.

you shouldn't show of gobbledygook users. it's meaningless of them , doesn't you. suspect, exposes internals of implementation may suggest vulnerabilities malicious user might able use.

instead, should catch exceptions, log them, , show more comprehensible error message users. can use getmessage() extract message part of exception. if exception has no message, show "no details available".

update:

i have comments based on question update. first, totally insulate user of internals of system, both kind user , security. (for instance, knowing using java.sql package may suggest vulnerabilities clever hacker.) not use exception message, first line of stack trace, or when displaying user.

second, should mapping errors exception level (at experienced in code) messages @ right level of abstraction user. proper way depend on internals of system , user might have been trying when exception raised. might mean structuring system layers such each layer catches exception translates exception @ higher layer of abstraction. java exception can wrap exceptions (the cause). instance:

public boolean copyfile(file source, file destination) throws copyexception {     try {         // lots of code         return true;     } catch (ioexception e) {         throw new copyexception("file copy failed", e);     } } 

then used @ higher level in user class:

public boolean sharefile(file source, user otheruser) throws shareexception {     if (otheruser.hasblocked(this) {         throw new shareexception("you cannot share user.");     }     try {         return copyfile(source, otheruser.getsharedfiledestination(source));     } catch (copyexception e) {         throw new shareexception("sharing failed due internal error", e);     } } 

(i hope it's clear above code meant illustrate idea of converting exceptions higher levels of abstraction, not suggestion code should use in system.)

the reason want handle things (instead of somehow massaging message and/or stack trace) exception (for instance ioexception message "permission denied") may mean totally different things user (and system) in different contexts.


Comments

Popular posts from this blog

django - How can I change user group without delete record -

java - Need to add SOAP security token -

java - EclipseLink JPA Object is not a known entity type -