Aaron Lahey 82fc62ca71 Use static message when raising HTTP request parameter parse errors ... When parsing HTTP request parameters, Rails delegates to a set of parsing strategies based on the MIME type. If any of these strategies raises an error Rails rescues it and raises an instance of `ActionDispatch::Http::Parameters::ParseError` with the same message as the underlying error. However, in the presence of malformed JSON, the default parameter parser for the `application/json` MIME type raises a `JSON:ParserError` with a message containing the entire malformed JSON string (the request body in this context). By raising a new error with this same message Rails inadvertently ends up logging the full HTTP request body at the `fatal` level. This request body could contain sensitive information or could be intentionally crafted to be extremely large. This commit sets the `ActionDispatch::Http::Parameters::ParseError` message to a static message which mirrors that of the corresponding `debug` log.		2021-08-28 11:56:05 -05:00
..
json_params_parsing_test.rb	Use static message when raising HTTP request parameter parse errors	2021-08-28 11:56:05 -05:00
multipart_params_parsing_test.rb	Use image/jpeg instead of non-standard image/jpg	2021-03-05 13:14:11 -05:00
query_string_parsing_test.rb
session_test.rb
url_encoded_params_parsing_test.rb