[#13356] - Do not include the SQL query in the Exception message
- Fixed in Code Base
- 2 Jan 2017
- Medium
- Build: staging
- # 13356
- Diff
- mbabker:no-sql-in-message
- Success continuous-integration/drone the build was successful Details
- Success continuous-integration/travis-ci/pr The Travis CI build passed Details
- Success JTracker/HumanTestResults Human Test Results: 2 Successful 0 Failed. Details
User tests: Successful: Unsuccessful:
Summary of Changes
Including the SQL query in the Exception message is a mild information disclosure in that it displays to the user the failed SQL query and exposes information about the database structure. This PR removes the query from the Exception message retaining only the engine's error message.
The JDatabaseExceptionExecuting object has a $query property (accessible via getQuery()) that contains the failed SQL query. For debugging purposes, if you need access to the failed query, you should extract it from the Exception's property versus relying on the message.
Testing Instructions
Create a query failure that triggers the error page. Pre-patch, the error message will contain the query. Post-patch, it will not.
Documentation Changes Required
Note that the query is not exposed as part of the Exception message any longer, developers must read it from the JDatabaseExceptionExecuting object's $query property.
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Libraries Postgresql MS SQL |
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13356.
Didn't remember that was there. Either way the change needs to be merged in sooner than later. I don't know why there's a bad test on that other PR because there is no code change to duplicate the error output.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13356.
fully agree, i close mine in favour of this one.
p.s.
the bad test on the other one should be because of the tested query was executed twice
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13356.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/13356.
| Milestone |
Added: |
||
rdeutz
- | Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-01-02 00:57:40 |
| Closed_By | ⇒ | rdeutz |
@test I used a cli script to test this and works as expected using MySQL database.
Executed script before patch:
Executed script after patch:
Script used here: https://github.com/fastslack/joomla-cli-tools/blob/master/JoomlaTests/issue-13356/Issue13356