fix(connectors): redact auth headers and cookies from check error details

Merged
RA
4d ago
+49-3

Description

Stacked on #16287, the top of the connector checks stack (GitHub stack #16195). It fixes a credential leak that #16160 introduced.

Problem

  • JIRAError.__str__ prints the request and response headers. These hold Authorization: Basic <base64(email:token)> and the session cookies.
  • _translate_errors used str(e) as the message of JiraApiError. The SDK error also stays in the exception chain, so the stored stack trace prints it.
  • Redaction removes only the raw credential strings. The credential is base64-encoded in the header, so it was not removed.
  • Result: an unexpected Jira error, such as a 5xx, stored the encoded credential in the check report. Curators can read that report.

Fix

  • JiraApiError gets a message without headers: JiraError HTTP <status>.
  • JiraApiError is raised from None, so the JIRAError and its header dump never reach the stored stack trace. Status, method, URL and Jira's error body stay on JiraApiError, so error details keep them.
  • The existing scrub_sensitive_values covers the rest. There are no custom header regexes: the only source of printed headers is closed.
  • _translate_errors no longer raises AttributeError when a JIRAError response has no request. That error replaced the JiraApiError that callers catch.

Not in this PR

  • Reports stored before this fix can still hold leaked traces. This code is not on main, so only test deployments of the stack are affected.
  • The result message is still not scrubbed for a raw requests.HTTPError.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

Summary by cubic

Fixes a credential leak where Jira check errors stored the base64-encoded Basic auth header and session cookies in error details.

  • The leak came from JIRAError.__str__ printing request and response headers; JiraApiError now uses a header-free message (JiraError HTTP <status>) and drops the SDK error from its chain, so neither the message nor the stored stack trace holds the headers.
  • Reading the request method now null-guards e.response.request, so an error without a request is no longer replaced by an AttributeError.

Reports stored before this fix may still contain leaked traces; raw requests.HTTPError messages remain unscrubbed.

Summary by CodeRabbit

  • Bug Fixes
    • Improved Jira error messages to prevent sensitive credentials and cookie data from being exposed.
    • Preserved relevant response details, including status and body information, for troubleshooting.
    • Prevented authorization headers from appearing in error messages or stored stack traces.