Exclude sensitive info from the jackson serialization stacktraces (#3195

) If Jackson can't parse JSON body it throws `IOException` which contains the whole request body including hashes, passwords and so on. This property was added in 2.9 version, so the body will be excluded from logs. Instead, Jackson adds `UNKNOWN` for the source and provides the property name it can't parse. Signed-off-by: Andrey Pleskach <[email protected]>
opensearch-project · Aug 16, 2023 · 0d915e2 · 0d915e2
1 parent 7e33bf3
commit 0d915e2
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/main/java/org/opensearch/security/DefaultObjectMapper.java b/src/main/java/org/opensearch/security/DefaultObjectMapper.java
@@ -57,6 +57,10 @@ public class DefaultObjectMapper {
 
     static {
         objectMapper.setSerializationInclusion(Include.NON_NULL);
+        // exclude sensitive information from the request body,
+        // if jackson cant parse the entity, e.g. passwords, hashes and so on,
+        // but provides which property is unknown
+        objectMapper.disable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION);
         // objectMapper.enable(DeserializationFeature.FAIL_ON_TRAILING_TOKENS);
         objectMapper.enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION);
         defaulOmittingObjectMapper.setSerializationInclusion(Include.NON_DEFAULT);