PII data can be present in exception messages that are captured

[trask]

Reported via technical committee responsible disclosure inbox:

When an exception occurs performing some database interaction, such as a batch update, the OpenTelemetry
Java auto-instrumentation will appropriately sanitize the db.statement attribute, as well as any other
relevant attributes, if any. However, the auto-instrumentation will NOT sanitize any exception messages
that are provided to it, such as a java.sq.BatchUpdateException. This leaves the possibility of PII and
other potential user information being leaked in the generated span.

Is it possible to leverage the existing database sanitizers to attempt to sanitize the db exception message
prior to adding the exception message as a span attribute?

[aaronjamesford]

I have ended up here after raising a similar issue RE exception messages in spans with Spring Framework. They have suggested I raise an issue with the OTel agent but I see there are already a few related issues open.

Are you happy adding an additional case to this issue or would you like me to open a new, dedicated one?

[mateuszrzeszutek]

Are you happy adding an additional case to this issue or would you like me to open a new, dedicated one?

It's fine to keep it in this one, it's the same problem after all.

[trask]

hi @aaronjamesford! can you share more details about the span on which this exception is captured? (in particular I'm curious if it's the top-most SERVER span, or an INTERNAL span)

also, does this exception bubble up and get logged in your application logs? or is it captured somewhere and so avoids getting logged?

[aaronjamesford]

It is appearing in an internal span and it looks as if the span name is the controller class and method (MyController.myMethod).

Library info on the span:
Library Name: io.opentelemetry.spring-webmvc-6.0
Library Version: 1.25.0-alpha

This isn't bubbling up or showing in logs as we have a controller advice that handles this specific exception

[trask]

thanks! this is really helpful.

@mateuszrzeszutek @laurit another check against controller spans 😞

[trask]

@aaronjamesford if you don't need these controller spans, you can suppress them: https://opentelemetry.io/docs/instrumentation/java/automatic/agent-config/#suppressing-controller-andor-view-spans