HawtIO Jolokia request validation
Issue
- For request with invalid post data sent to the URL:
http://<FABRIC_CONTAINER_HOST>:8182/hawtio/jolokia/
- Server responds with stack trace included
### INVALID POST DATA
URL:
http://localhost:8181/hawtio/jolokia/?maxDepth=7&maxCollectionSize=5000&ignoreErrors=true&canonicalNaming=false
POST DATA:
pe":"read","mbean":"hawtio:type=Registry","attribute":"UpdateCounter","config":{}},{"type":"read","mbean":"hawtio:type=TreeWatcher","attribute":"Counter","config":{}},{"type":"exec","mbean":"io.fabric8:type=Fabric","operation":"versions(java.util.List)","arguments":[["id","defaultVersion"]],"config":{}},{"type":"exec","mbean":"io.fabric8:type=Fabric","operation":"containers(java.util.List, java.util.List)","arguments":[["id","profileIds","profiles","versionId","location","alive","type","ensembleServer","provisionResult","root","jolokiaUrl","jmxDomains","metadata","parentId"],["id","hidden","version","summaryMarkdown","iconURL","tags"]],"config":{}},{"type":"read","mbean":"io.fabric8:type=ClusterServiceManager","attribute":"EnsembleContainers","config":{}}]
RESPONSE:
{
"error": "java.lang.IllegalArgumentException : Invalid JSON request java.io.InputStreamReader@5f98e533",
"error_type": "java.lang.IllegalArgumentException",
"stacktrace": "java.lang.IllegalArgumentException: Invalid JSON request java.io.InputStreamReader@5f98e533\n\tat org.jolokia.http.HttpRequestHandler.extractJsonRequest(HttpRequestHandler.java:181)\n\tat org.jolokia.http.HttpRequestHandler.handlePostRequest(HttpRequestHandler.java:121)\n\tat org.jolokia.http.AgentServlet$3.handleRequest(AgentServlet.java:420)\n\tat org.jolokia.http.AgentServlet.handleSecurely(AgentServlet.java:301)\n\tat org.jolokia.http.AgentServlet.handle(AgentServlet.java:277)\n\tat org.jolokia.http.AgentServlet.doPost(AgentServlet.java:244)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:707)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:790)\n\tat org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:812)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1669)\n\tat io.hawt.web.AuthenticationFilter$3.run(AuthenticationFilter.java:201)\n\tat java.security.AccessController.doPrivileged(Native Method)\n\tat javax.security.auth.Subject.doAs(Subject.java:422)\n\tat io.hawt.web.AuthenticationFilter.executeAs(AuthenticationFilter.java:198)\n\tat io.hawt.web.AuthenticationFilter.doFilter(AuthenticationFilter.java:136)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat io.hawt.web.XXSSProtectionFilter.doFilter(XXSSProtectionFilter.java:28)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat io.hawt.web.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:28)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat io.hawt.web.CORSFilter.doFilter(CORSFilter.java:42)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat io.hawt.web.CacheHeadersFilter.doFilter(CacheHeadersFilter.java:37)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat io.hawt.web.SessionExpiryFilter.process(SessionExpiryFilter.java:148)\n\tat io.hawt.web.SessionExpiryFilter.doFilter(SessionExpiryFilter.java:46)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat io.hawt.web.RedirectFilter.process(RedirectFilter.java:73)\n\tat io.hawt.web.RedirectFilter.doFilter(RedirectFilter.java:38)\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)\n\tat org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)\n\tat org.ops4j.pax.web.service.jetty.internal.HttpServiceServletHandler.doHandle(HttpServiceServletHandler.java:71)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)\n\tat org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)\n\tat org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)\n\tat org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)\n\tat org.ops4j.pax.web.service.jetty.internal.HttpServiceContext.doHandle(HttpServiceContext.java:287)\n\tat org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)\n\tat org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)\n\tat org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)\n\tat org.ops4j.pax.web.service.jetty.internal.JettyServerHandlerCollection.handle(JettyServerHandlerCollection.java:80)\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)\n\tat org.eclipse.jetty.server.Server.handle(Server.java:499)\n\tat org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)\n\tat org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)\n\tat org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)\n\tat java.lang.Thread.run(Thread.java:745)\nCaused by: Unexpected character (b) at position 0.\n\tat org.json.simple.parser.Yylex.yylex(Yylex.java:610)\n\tat org.json.simple.parser.JSONParser.nextToken(JSONParser.java:269)\n\tat org.json.simple.parser.JSONParser.parse(JSONParser.java:118)\n\tat org.json.simple.parser.JSONParser.parse(JSONParser.java:92)\n\tat org.jolokia.http.HttpRequestHandler.extractJsonRequest(HttpRequestHandler.java:179)\n\t... 49 more\n",
"status": 400
}
-
Is there a way to configure Fabric/HawtIO/Jolokia to not include stack trace element in such cases?
-
Note that for invalid URL argument there is no stack trace included in response.
Environment
- Red Hat JBoss Fuse
- 6.3.0
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.