Added an option to suppress exception details#3011
Conversation
|
@dwat001 I forgot that we use |
Based on a new ConnectionString property SuppressDetailInPostgressError drop the DETAILS field sent by postgres as this often contains user data which may be sensitive. # Conflicts: # src/Npgsql/PostgresException.cs
da1ea0e to
a1afd65
Compare
Based on a new connection string property, suppress the logging of Command parameters.
@YohDeadfall I have rebased onto |
|
Thanks! After merging this, the changes will appear in 5.0. To have them in 4.x versions we will backport/cherry-pick commits on our side, so no additional actions required for you. |
|
Thanks @YohDeadfall, could you please ping #2501 or this PR once it is cherry-picked? For clarity is there any further work required on this PR for it to be ready for merging? Thank you. |
|
On backporting we add a comment to specify a cherry pick commit and the corresponding branch. |
YohDeadfall
left a comment
There was a problem hiding this comment.
Looks good, but let's add a test to prevent a future regression. It should be in ExceptionTests.
| break; | ||
| case ErrorFieldTypeCode.Detail: | ||
| detail = buf.ReadNullTerminatedStringRelaxed(); | ||
| if(suppressDetailInPostgressError && string.IsNullOrEmpty(detail) == false) |
There was a problem hiding this comment.
It would be better to use the negation operator here rather than comparison, but it's a bit.
As per review use not operator instead of comparison to false.
Conditionally suppress exception details (cherry picked from commit adefbbf)
|
Backported to 4.1.4 via 6fe5cde. |
Conditionally suppress exception details (cherry picked from commit adefbbf)
|
To 4.0.11 it was backported via 3f81746. |
|
Thank you for your time on this @YohDeadfall . |
| sb.Append("\t").AppendLine(s.SQL); | ||
| var p = s.InputParameters; | ||
| if (NpgsqlLogManager.IsParameterLoggingEnabled && p.Count > 0) | ||
| if (NpgsqlLogManager.IsParameterLoggingEnabled && p.Count > 0 && excludeParametersFromLogs == false) |
There was a problem hiding this comment.
This means that NpgsqlLogManager.IsParameterLoggingEnabled has to be enabled regardless of what's on the connection string - that seems to make the new connection string option pretty useless. I think it should be possible to simply enable parameter logging via one or the other mechanism.
As per comments in the Issue, this PR deals with both PostgresException.Details and the logging of command parameters.
This is related to PR #3008 which does the same for the 3.X branch.