Stop hibernate from throwing sensitive data when an exception is thrown - spring-boot

I am new to hibernate and Im using JPA +Hibernate + Spring Boot for my applications. The logging is being handled using log4j2 . When my application is correctly throwing an exception (in my case DataIntegrityViolationException or EntityExistsException) Hibernate is logging the exception with stackTrace. Which is great as it helps debug. However it also logs application sensitive data which I do not want to be present in the logs. Is there a setting in the properties file that can be set or modified to prevent this from happening. I don’t want to create an appender for hibernate in my log4j2.xml and mask specific words in the final log.

You can add global exception in spring boot and you can log the exception message only follow this tutorial - https://www.studytonight.com/spring-boot/spring-boot-global-exception-handling
Or you can do some try catch for each call and throw exception with your customized message as below.
Try {
//call
} catch (Exception ex){
throws CustomizedRunTimeException(“yourMessage”)
}
The class look like below
public class CustomizedRunTimeException extends RunTimeException {
public CustomizedRunTimeException(String errorMessage) {
super(errorMessage);
}
}

Related

JOOQ execution listener does not catch exception

I'm trying to implement a generic solution for optimized locking. What I want to achieve is to have a specific piece of code run when record's version changes. I have it implemented as an ExecuteListener instance that looks for DataChangedException. It's registered as a Spring bean.
class LockingListener : DefaultExecuteListener() {
override fun exception(ctx: ExecuteContext) {
val exception = ctx.exception()
if (exception is DataChangedException) {
ctx.exception(IllegalStateException("Accessed data has been altered mid-operation."))
}
}
}
#Configuration
class JooqConfig {
#Bean
fun lockingListenerProvider() = DefaultExecuteListenerProvider(LockingListener())
}
I had a breakpoint set in org.jooq.impl.ExecuteListeners#get and it does look like it gets picked up alongside LoggerListener and JooqExceptionTranslator.
When I try to run a test case though, DataChangedException does not get picked up on UpdateableRecord#update and I get the following stacktrace instead, no IllegalStateException in sight.
org.jooq.exception.DataChangedException: Database record has been changed or doesn't exist any longer
at org.jooq.impl.UpdatableRecordImpl.checkIfChanged(UpdatableRecordImpl.java:540)
at org.jooq.impl.UpdatableRecordImpl.storeMergeOrUpdate0(UpdatableRecordImpl.java:349)
at org.jooq.impl.UpdatableRecordImpl.storeUpdate0(UpdatableRecordImpl.java:241)
at org.jooq.impl.UpdatableRecordImpl.access$100(UpdatableRecordImpl.java:89)
at org.jooq.impl.UpdatableRecordImpl$2.operate(UpdatableRecordImpl.java:232)
at org.jooq.impl.RecordDelegate.operate(RecordDelegate.java:149)
at org.jooq.impl.UpdatableRecordImpl.storeUpdate(UpdatableRecordImpl.java:228)
at org.jooq.impl.UpdatableRecordImpl.update(UpdatableRecordImpl.java:165)
Debugging shows that LockingListener#exception does not even get entered into.
That exception is not part of the ExecuteListener lifecycle, i.e. the lifecycle that deals with interactions with the JDBC API. In other words, it's not a SQLException, it happens higher up the stack. Use the RecordListener.exception() callback, instead.

Quarkus hibernate validations exceptions not showing on the console

I have a simple project using Quarkus 1.4.2. When I use the #Valid annotation, and the validations fail with a status 500, the exception is not show on the console. Only in the Swagger UI. What should I do to print it out on the console?
#ApplicationScoped
public class ProductService {
public void validateProduct(#Valid Product product) {
}
}
The exception that is occurring is:
javax.validation.UnexpectedTypeException: HV000030: No validator could be found for constraint
The error is correct. It is just not shown on the console.
I would expect the error to be logged as it's definitely a usability issue. And I would expect it to be logged on startup when we collect the Hibernate Validator metadata, not for every call.
You could create a reproducer and open a GitHub issue in the Quarkus tracker here.
I'll check it out and see if something needs fixing.
If I understand correctly, you need to use the Validator object in order to catch possible Exceptions:
#Inject
Validator validator;
public void validateProduct(Product product) {
// Should throw an error
Set<ConstraintViolation<Product>> violations = validator.validate(product);
if(violations.isEmpty()) {
return;
}
for (ConstraintViolation<Product> violation : violations) { // or log whole set as json
System.out.println(violation.toString()); //TODO prettify
}
throw new ValidationException(JsonbBuilder.create().toJson(violations));
}
If you get a 500 error, you can now catch it and log.
Or just catch UnexpectedTypeException where you call your service. This might be better.

How to trap error with a transactional annotation?

I use spring boot 2.2.
In a method with transactional anocation, when I save via repository if there is no error, I want to send a message with rabbit mq.
How to be sure there is no error with repository?
#Transactional
public void save(CreditEvent creditEvent) {
repository.save(creditEvent);
//no error send message
}
if there is an error when sending message, I don't want to rollback saving operation.
Although it's Transactional and JPA, still it's a java method which if save failed then unchecked DataAccessException exception will be thrown and flow won't continue to send message.
class is a runtime exception, there is no need for user code to catch it or subclasses if any error is to be considered fatal (the usual case).
#Transactional
public void save(CreditEvent creditEvent) {
try {
repository.save(creditEvent);
//no error send message}
catch {
// send message
// rethrow error
}
}

Spring Boot logging - Don't log ConstraintViolationExceptions

Here's my problem. I call a service method in the controller which is annotated with #Transactional. If this is comitted, a ConstraintViolationException occurs. I would like to catch it and put it into my own exception. Now I have the problem that I can catch the TransactionSystemException, but an error has already been logged. Can I prevent this somehow?
public ResponseEntity<T> update(String id, T obj) {
try {
return getResponseEntity(service.update(id, obj));
} catch (TransactionSystemException ex) {
System.out.println("CATCHED");
throw new InternalErrorException();
}
}
During my research I found out that I can disable logging for certain packages like
logging.level.org.springframework.dao.DataIntegrityViolationException=OFF
or
logging.level.org.hibernate.TransactionException=OFF
But that didn't help and I don't want to disable logging completely with logging.level.org.hibernate=OFF.
Please try to use #ControllerAdvice.
https://spring.io/blog/2013/11/01/exception-handling-in-spring-mvc
https://medium.com/#jovannypcg/understanding-springs-controlleradvice-cd96a364033f

How to handle Spring data exceptions in the repository layer

I am writing a REST application using Spring. It is divided into 3 layers, controller, service and repository.
The repository layer are using Spring data and MongoDb. The exceptions from MongoDb are translated to Spring Data exceptions.
Using the #ExceptionHandler annotation I tried to catch those exceptions in the repository layer. This did not work. The only way to catch the exception with #ExceptionHandler is to put the code in the controller layer.
Is there a way for me to catch and handle the exceptions in the repository layer,, without using try/catch blocks.
It could be done with Spring AOP and by creating an #Around advice for all your DAO methods as shown below.
But I would still like to understand what you plan to do in your catch block. Are you planning to have different logic to handle different types of data access exceptions? If you don't have any specific logic, it makes sense to just let the exception propagate to the controller layer.
First Option
Here is a sample -
#Aspect
public class DaoExceptionHandlerAdvice {
#Around("execution( * com.xyz.daos.*.*(..))")
public Object invokeService(ProceedingJoinPoint pjp) throws Throwable{
MethodSignature methodSignature = (MethodSignature)pjp.getSignature();
Object returnValue = null;
try {
returnValue = pjp.proceed();
}
catch(Exception e){
// handle the exception
}
finally{
}
return returnValue;
}
}
Add following snippet in your application context file
<aop:aspectj-autoproxy />
<bean id="daoExceptionHandler" class="com.xyz.advice.DaoExceptionHandlerAdvice" ></bean>
Check out the following link for details -
Spring AOP
Second Option
I've not tried this, but it would probably be easier for you to use an exception translator. You could probably extend HibernateExceptionTranslator and have your own logic in there.
Follow this link for details -
Exception Translation

Resources