Skip to content

fix(logging): reduce verbose logging for security. Fixes #12293 #12295

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 10, 2025
Merged

fix(logging): reduce verbose logging for security. Fixes #12293 #12295

merged 1 commit into from
Oct 10, 2025
+145 −63

Conversation

JerT33
Copy link
Contributor

@JerT33 JerT33 commented Sep 26, 2025 •
edited
Loading

Description of your changes:
Sanitizes error logging in pipeline upload and K8s pod API endpoints within the frontend service. This help prevents information disclosure by returning generic error responses, while preserving debug information for troubleshooting. This also helps prevent against the ability to run scripts as shown in #12293

Fixes #12293

Checklist:

@google-oss-prow Google OSS Prow
Copy link

Hi @JerT33. Thanks for your PR.

I'm waiting for a kubeflow member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@github-actions GitHub Actions
Copy link

🚫 This command cannot be processed. Only organization members or owners can use the commands.

@droctothorpe
Copy link
Collaborator

/ok-to-test

@github-actions GitHub Actions
Copy link

Approvals successfully granted for pending runs.

@droctothorpe droctothorpe force-pushed the feat/remove_verbose_logging branch from 74c5f10 to 07eb3bf Compare October 3, 2025 14:03
droctothorpe
droctothorpe reviewed Oct 3, 2025
View reviewed changes
droctothorpe
droctothorpe reviewed Oct 3, 2025
View reviewed changes
@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch from 03685c8 to 0ad2011 Compare October 3, 2025 17:28
@google-oss-prow google-oss-prow bot added size/L and removed size/M labels Oct 3, 2025
@JerT33 JerT33 requested a review from droctothorpe October 3, 2025 19:23
@droctothorpe droctothorpe force-pushed the feat/remove_verbose_logging branch from 4ed4ef7 to 2c5ec31 Compare October 3, 2025 22:03
@droctothorpe
Copy link
Collaborator

droctothorpe commented Oct 3, 2025 •
edited
Loading

Thanks for the incorporating the feedback, @JerT33.

/lgtm

@droctothorpe
Copy link
Collaborator

Looks like there are some test errors. Also, can you please squash your commits to just one commit. Thanks!

@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch 4 times, most recently from 68343b2 to 734a1fb Compare October 6, 2025 00:43
@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch 2 times, most recently from 36e9098 to 3156864 Compare October 8, 2025 17:53
@google-oss-prow google-oss-prow bot added size/XXL and removed size/L labels Oct 8, 2025
@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch 2 times, most recently from e07d494 to d240490 Compare October 8, 2025 18:38
@google-oss-prow google-oss-prow bot added size/L and removed size/XXL labels Oct 8, 2025
@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch from bce8f61 to 0e92da3 Compare October 8, 2025 18:50
@google-oss-prow google-oss-prow bot added size/XXL and removed size/L labels Oct 8, 2025
@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch from 0e92da3 to d240490 Compare October 8, 2025 21:52
@google-oss-prow google-oss-prow bot added size/L and removed size/XXL labels Oct 8, 2025
@droctothorpe
Copy link
Collaborator

Looks like you have some merge conflicts that need to be addressed in order to rebase, @JerT33.

@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch 2 times, most recently from 04f26e0 to 999f65d Compare October 9, 2025 20:33
@JerT33
make error messages more vague + sanitize resource names
e8b1b9b 
Signed-off-by: JerT33 <[email protected]>

add back additionalinfo as optional

Signed-off-by: JerT33 <[email protected]>

make k8s error logs more generic to protect against xss

Signed-off-by: JerT33 <[email protected]>

remove verbose logging for minio get artifact handler

Signed-off-by: JerT33 <[email protected]>

sanitize rather than remove resource names + revert backend error logs

Signed-off-by: JerT33 <[email protected]>

fix typo + add invalid resource name tests

Signed-off-by: JerT33 <[email protected]>

add valid namespace check for tensorboard

Signed-off-by: JerT33 <[email protected]>

update pipeline upload server responses + log verbose error messages

Signed-off-by: JerT33 <[email protected]>

remove error wrap from backend error logs

Signed-off-by: JerT33 <[email protected]>

minor updates to satisfy pre commit checks

Signed-off-by: JerT33 <[email protected]>

update tensor board file to ensure namespace is a str

Signed-off-by: JerT33 <[email protected]>

update frontend code format + backend test cases

Signed-off-by: JerT33 <[email protected]>

update pipeline upload test cases to pass pre commit

Signed-off-by: JerT33 <[email protected]>

fix minor merge typo

Signed-off-by: JerT33 <[email protected]>

fix minor merge typo

Signed-off-by: JerT33 <[email protected]>
@JerT33 JerT33 force-pushed the feat/remove_verbose_logging branch from 999f65d to e8b1b9b Compare October 9, 2025 20:37
@zazulam
Copy link
Collaborator

zazulam commented Oct 9, 2025

/lgtm

@google-oss-prow google-oss-prow bot added the lgtm label Oct 9, 2025
@zazulam
Copy link
Collaborator

zazulam commented Oct 10, 2025

/unhold

@zazulam
Copy link
Collaborator

zazulam commented Oct 10, 2025

/approve

@google-oss-prow Google OSS Prow
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zazulam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@google-oss-prow google-oss-prow bot merged commit fedc25e into kubeflow:master Oct 10, 2025
62 checks passed
@JerT33 JerT33 deleted the feat/remove_verbose_logging branch October 10, 2025 15:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mprahl mprahl Awaiting requested review from mprahl

@droctothorpe droctothorpe Awaiting requested review from droctothorpe

Assignees

@zazulam zazulam

@droctothorpe droctothorpe

Labels

approved lgtm ok-to-test size/L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[bug] Reduce verbose error logging to improve security

3 participants

@JerT33 @droctothorpe @zazulam