Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix improper error handling #296

Merged
merged 7 commits into from
Jan 24, 2019
Merged

Fix improper error handling #296

merged 7 commits into from
Jan 24, 2019

Conversation

crd1985
Copy link
Contributor

@crd1985 crd1985 commented Jan 24, 2019

Description

This PR closes #292, closes #293.

Fixes the policy of error reporting of Wazuh API. Instead of returning the full description of errors in the API responses, it writes them in the api.log file when debug mode is enabled.
This avoids showing private filepaths or any other information useful for an attacker.

Tests performed

Sent some request to an api in debug mode.

  • Try internal error on console and see the api.log
# curl -u foo:bar "localhost:55000/cluster/node045/stats?pretty"{
   "error": 1000,
   "message": "Internal error"
}
## In api.log file...
WazuhAPI 2019-01-24 11:06:38 foo: totals() got an unexpected keyword argument 'node_id'
WazuhAPI 2019-01-24 11:06:38 foo: [::ffff:127.0.0.1] GET /cluster/node045/stats?pretty - 200 - error: '1000'.
  • Try other errors
# curl -u foo:bar "localhost:55000/agents/groups/default/files/passwd?pretty"
{
   "error": 1006,
   "message": "File/directory does not exist"
}
## In api.log file...
WazuhAPI 2019-01-24 11:14:42 foo: File/directory does not exist: /var/ossec/etc/shared/default/passwd
WazuhAPI 2019-01-24 11:14:42 foo: [::ffff:127.0.0.1] GET /agents/groups/default/files/passwd?pretty - 200 - error: '1006'.
# curl -u foo:bar "localhost:55000/agents/groups/perere?pretty"
{
   "error": 1710,
   "message": "The group does not exist"
}
## In api.log file...
WazuhAPI 2019-01-24 11:15:31 foo: The group does not exist: perere
WazuhAPI 2019-01-24 11:15:31 foo: [::ffff:127.0.0.1] GET /agents/groups/perere?pretty - 200 - error: '1710'.
# curl -u foo:bar -k -X POST -d '{"name":"NewHost","ip""10.0.0.9"}' -H 'Content-Type:application/json' "http://127.0.0.1:55000/agents?pretty"
{"error":"614","message":"Invalid request. Body is not correct."}
## In api.log file...
WazuhAPI 2019-01-24 11:23:11 foo: [::ffff:127.0.0.1] POST /agents?pretty - 400 - error: '614'.

@jesuslinares jesuslinares merged commit 223e54e into 3.8 Jan 24, 2019
@jesuslinares jesuslinares deleted the fix-cross-site-scripting branch January 24, 2019 12:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants