OSC is returning internal URLs in error messages

[SchoolGuy]

While working on a package in my home-project I accidentally misconfigured my service file which lead to an error. Apparently the client leaks in it's error message internal (for a user not reachable) URLs. Example can be seen below.

Output of osc --version: 0.168.2

> osc -A https://api.opensuse.org build --clean
Building onedrive.spec for openSUSE_Tumbleweed/x86_64
Getting buildconfig from server and store to /home/enno/Sources/External_Build_Service/home:SchoolGuy:branches:home:bmanojlovic:onedrive/onedrive/.osc/_buildconfig-openSUSE_Tumbleweed-x86_64
Getting buildinfo from server and store to /home/enno/Sources/External_Build_Service/home:SchoolGuy:branches:home:bmanojlovic:onedrive/onedrive/.osc/_buildinfo-openSUSE_Tumbleweed-x86_64.xml
Server returned an error: HTTP Error 400: Bad Request
remote error: element 'services' contains content (http://back-home-opensuse:5252/build/home:SchoolGuy:branches:home:bmanojlovic:onedrive/openSUSE_Tumbleweed/x86_64/onedrive/_buildinfo?add=gdb&add=vim&add=strace&add=less&add=rzsz)

[marcus-h]

On 2020-04-16 02:00:37 -0700, Enno G. wrote: ```` > osc -A https://api.opensuse.org build --clean Building onedrive.spec for openSUSE_Tumbleweed/x86_64 Getting buildconfig from server and store to /home/enno/Sources/External_Build_Service/home:SchoolGuy:branches:home:bmanojlovic:onedrive/onedrive/.osc/_buildconfig-openSUSE_Tumbleweed-x86_64 Getting buildinfo from server and store to /home/enno/Sources/External_Build_Service/home:SchoolGuy:branches:home:bmanojlovic:onedrive/onedrive/.osc/_buildinfo-openSUSE_Tumbleweed-x86_64.xml Server returned an error: HTTP Error 400: Bad Request remote error: element 'services' contains content (http://back-home-opensuse:5252/build/home:SchoolGuy:branches:home:bmanojlovic:onedrive/openSUSE_Tumbleweed/x86_64/onedrive/_buildinfo?add=gdb&add=vim&add=strace&add=less&add=rzsz) ````

That's not an osc issue. From a quick glance, it seems to be related to commit 26fe5ca ("[backend] added uri to 'remote error' message") (which is part of the open-build-service repo).

[SchoolGuy]

@adrianschroeter Could you then possibly transfer this issue to the obs repo? I guess this kind of information should not be leaked to the outside.

[lethliel]

I am not Adrian, but I transferred the issue

[SchoolGuy]

@lethliel Fine with me as well :D, just knew that Adrian should have the rights...