Skip to content

[TC-007] - Prevent response body leakage in RestRetryInterceptor #3679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kdeakinstructure wants to merge 3 commits into from
Closed

[TC-007] - Prevent response body leakage in RestRetryInterceptor #3679

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6182f1a
Prevent response body leakage in RestRetryInterceptor. Instead, only …
kdeakinstructure May 4, 2026
158b7c8
Delete println with body in it.
kdeakinstructure May 7, 2026
d3634f8
Merge branch 'master' into TC-007-prevent-response-body-leakage-in-re…
kdeakinstructure May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions ...n/dataseedingapi/src/main/kotlin/com/instructure/dataseeding/util/RestRetryInterceptor.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,9 @@ object RestRetryInterceptor : Interceptor {

if (response.failed) {
val code = response.code
val body = response.body?.string()
throw RuntimeException("status code: $code\nbody: $body")
val contentType = response.body?.contentType()
response.close()
throw RuntimeException("status code: $code, content-type: $contentType")

@claude claude Bot May 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The body was deliberately removed from the exception message (previously it was included). This is a silent behavior change: callers that catch and log RuntimeException — or test frameworks that only capture the exception trace — will no longer see the response body. The println on line 45 helps when stdout is captured, but that isn't guaranteed in all CI environments.

Consider including at least the (possibly truncated) body in the message so the information travels with the exception:

throw RuntimeException("status code: $code, content-type: $contentType, body: ${body?.take(500)}")

If the motivation for removing it was to avoid giant messages, a truncation strategy like this gives the best of both worlds.

}

return response
Expand Down
Loading