Skip to content

Fix exposed connector URL in error message #3953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

rithin-pullela-aws
Copy link
Contributor

Description

This pull request addresses a security concern where user input, in this case specifically the connector URL was being exposed in error messages. Exposing such information can inadvertently leak sensitive data and does not align with security best practices.

Fix:
Updated the error handling logic to avoid printing the connector URL in error messages, thereby preventing potential information disclosure.

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

  • New functionality includes testing.
  • New functionality has been documented.
  • API changes companion pull request created.
  • Commits are signed per the DCO using --signoff.
  • Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@rithin-pullela-aws rithin-pullela-aws marked this pull request as draft June 30, 2025 18:13
@rithin-pullela-aws rithin-pullela-aws had a problem deploying to ml-commons-cicd-env-require-approval June 30, 2025 18:15 — with GitHub Actions Error
@rithin-pullela-aws rithin-pullela-aws had a problem deploying to ml-commons-cicd-env-require-approval June 30, 2025 18:15 — with GitHub Actions Error
@rithin-pullela-aws rithin-pullela-aws had a problem deploying to ml-commons-cicd-env-require-approval June 30, 2025 18:15 — with GitHub Actions Failure
@rithin-pullela-aws rithin-pullela-aws had a problem deploying to ml-commons-cicd-env-require-approval June 30, 2025 18:15 — with GitHub Actions Failure
@rithin-pullela-aws rithin-pullela-aws marked this pull request as ready for review June 30, 2025 18:19
Zhangxunmt
Zhangxunmt previously approved these changes Jun 30, 2025
Signed-off-by: rithin-pullela-aws <[email protected]>
Signed-off-by: rithin-pullela-aws <[email protected]>
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval June 30, 2025 19:15 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval June 30, 2025 19:15 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval June 30, 2025 19:15 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval June 30, 2025 19:15 — with GitHub Actions Inactive
@mingshl
Copy link
Collaborator

mingshl commented Jun 30, 2025

this exception message is throwing when user try to create a model using the connectors, so we can hide the url to avoid exposing endpoint info to users, but please suggest either update the trusted endpoint in connectors or check the connector url. I think these suggestions would be helpful

@rithin-pullela-aws
Copy link
Contributor Author

this exception message is throwing when user try to create a model using the connectors, so we can hide the url to avoid exposing endpoint info to users, but please suggest either update the trusted endpoint in connectors or check the connector url. I think these suggestions would be helpful

@mingshl, this error is thrown when we try to create the connector. So I believe the error message is good enough. Connector URL is not matching the trusted connector endpoint regex

@rithin-pullela-aws
Copy link
Contributor Author

I created an issue #3954 to expand this solution to other places where we expose use input.

@mingshl
Copy link
Collaborator

mingshl commented Jun 30, 2025

this exception message is throwing when user try to create a model using the connectors, so we can hide the url to avoid exposing endpoint info to users, but please suggest either update the trusted endpoint in connectors or check the connector url. I think these suggestions would be helpful

@mingshl, this error is thrown when we try to create the connector. So I believe the error message is good enough. Connector URL is not matching the trusted connector endpoint regex

then you can suggest to update the trusted endpoint in the cluster setting

@dhrubo-os
Copy link
Collaborator

this exception message is throwing when user try to create a model using the connectors, so we can hide the url to avoid exposing endpoint info to users, but please suggest either update the trusted endpoint in connectors or check the connector url. I think these suggestions would be helpful

@mingshl, this error is thrown when we try to create the connector. So I believe the error message is good enough. Connector URL is not matching the trusted connector endpoint regex

then you can suggest to update the trusted endpoint in the cluster setting

I think based on the input users can decide if they need to add trusted endpoint or not. What if they had some spelling mistake in their url?

@rithin-pullela-aws rithin-pullela-aws requested a deployment to ml-commons-cicd-env-require-approval June 30, 2025 23:00 — with GitHub Actions Waiting
@rithin-pullela-aws rithin-pullela-aws requested a deployment to ml-commons-cicd-env-require-approval June 30, 2025 23:00 — with GitHub Actions Waiting
Copy link

codecov bot commented Jun 30, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.60%. Comparing base (a894ff1) to head (44e3aaf).
Report is 3 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff              @@
##               main    #3953      +/-   ##
============================================
- Coverage     80.61%   80.60%   -0.02%     
+ Complexity     7945     7943       -2     
============================================
  Files           694      694              
  Lines         34872    34872              
  Branches       3885     3885              
============================================
- Hits          28113    28109       -4     
- Misses         5032     5033       +1     
- Partials       1727     1730       +3     
Flag Coverage Δ
ml-commons 80.60% <100.00%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Zhangxunmt Zhangxunmt merged commit d46a49f into opensearch-project:main Jul 3, 2025
10 of 13 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jul 3, 2025
* Fix exposed connector URL in error message

Signed-off-by: rithin-pullela-aws <[email protected]>

* Fix failing test

Signed-off-by: rithin-pullela-aws <[email protected]>

* spotless apply

Signed-off-by: rithin-pullela-aws <[email protected]>

---------

Signed-off-by: rithin-pullela-aws <[email protected]>
(cherry picked from commit d46a49f)
mingshl pushed a commit that referenced this pull request Jul 5, 2025
* Fix exposed connector URL in error message



* Fix failing test



* spotless apply



---------


(cherry picked from commit d46a49f)

Signed-off-by: rithin-pullela-aws <[email protected]>
Co-authored-by: Rithin Pullela <[email protected]>
mingshl pushed a commit to mingshl/ml-commons that referenced this pull request Jul 8, 2025
* Fix exposed connector URL in error message

Signed-off-by: rithin-pullela-aws <[email protected]>

* Fix failing test

Signed-off-by: rithin-pullela-aws <[email protected]>

* spotless apply

Signed-off-by: rithin-pullela-aws <[email protected]>

---------

Signed-off-by: rithin-pullela-aws <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants