Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanitise error throw in production builds #7270

Closed
amk221 opened this issue Aug 14, 2020 · 2 comments
Closed

Sanitise error throw in production builds #7270

amk221 opened this issue Aug 14, 2020 · 2 comments

Comments

@amk221
Copy link
Contributor

amk221 commented Aug 14, 2020

Description

Could Ember Data consider sanitising this error message in production builds?

setDirtyAttribute(key, value) {
if (this.isDeleted()) {
throw new EmberError(`Attempted to set '${key}' to '${value}' on the deleted record ${this}`);
}

There is a potential for third party logging services to capture sensitive data via the ${value}.

Although this is possibly not Ember Data's concern, and is instead the responsibility of the developer to fix the actual problem (which would be to not perform the set if the record is deleted in the first place).

Thanks for any insight

@igorT
Copy link
Member

igorT commented Aug 26, 2020

@amk221 Thats a very good point. In general having more context in errors is nice, but I completely see the issue here. I think in this case it might be easy to just remove the value part of the message. Do you want to open a PR with the change? @rwjblue do you know if ember has a flag/mode for removing context from error messages?

@amk221
Copy link
Contributor Author

amk221 commented Nov 4, 2020

Would welcome feedback on my PR attempt

@amk221 amk221 closed this as completed Feb 10, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants