github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Do not expose host in internal API error messages (#172645)

Browse source 
## Summary

Only expose the `path` instead of the full `url` in the internal route
handler error messages
This commit is contained in:
Pierre Gayvallet 2023-12-06 12:05:40 +01:00 • committed by GitHub
parent 11451b48b8
commit 9f3f22ae68
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
packages/core/http/core-http-server-internal/src/lifecycle_handlers.test.ts
View file

@ -301,6 +301,7 @@ describe('restrictInternal post-auth handler', () => {
name: 'my-server-name',
restrictInternalApis: true,
});
it('returns a bad request if called without internal origin header for internal API', () => {
const handler = createRestrictInternalRoutesPostAuthHandler(config as HttpConfig);
const request = createForgeRequest('internal');
@ -310,8 +311,8 @@ describe('restrictInternal post-auth handler', () => {
const result = handler(request, responseFactory, toolkit);
expect(toolkit.next).not.toHaveBeenCalled();
expect(responseFactory.badRequest.mock.calls[0][0]?.body).toMatch(
/uri \[.*\/internal\/some-path\] with method \[get\] exists but is not available with the current configuration/
expect(responseFactory.badRequest.mock.calls[0][0]?.body).toMatchInlineSnapshot(
`"uri [/internal/some-path] with method [get] exists but is not available with the current configuration"`
);
expect(result).toBe('badRequest');
});

2
packages/core/http/core-http-server-internal/src/lifecycle_handlers.ts
View file

@ -54,7 +54,7 @@ export const createRestrictInternalRoutesPostAuthHandler = (
if (isRestrictionEnabled && isInternalRoute && !request.isInternalApiRequest) {
// throw 400
return response.badRequest({
body: `uri [${request.url}] with method [${request.route.method}] exists but is not available with the current configuration`,
body: `uri [${request.url.pathname}] with method [${request.route.method}] exists but is not available with the current configuration`,
});
}
return toolkit.next();