Redact secrets from startup error logs (#4)

Co-authored-by: Per Magnus Petersen <magnus@pmagnus.dk>

deps.edn

@@ -3,6 +3,13 @@
 
  :deps    {org.clojure/clojure {:mvn/version "1.12.3"}
 
+           ;; Security overrides for transitive web/runtime dependencies.
+           com.fasterxml.jackson.core/jackson-core        {:mvn/version "2.21.4"}
+           com.fasterxml.jackson.core/jackson-databind    {:mvn/version "2.21.4"}
+           io.undertow/undertow-core                      {:mvn/version "2.3.21.Final"}
+           org.jboss.xnio/xnio-api                        {:mvn/version "3.8.14.Final"}
+           org.jboss.xnio/xnio-nio                        {:mvn/version "3.8.14.Final"}
+
            ;; Routing
  metosin/reitit {:mvn/version "0.9.2"}
 

src/clj/pmagnus/elprice/core.clj

@@ -19,9 +19,12 @@
 ;; log uncaught exceptions in threads
 (Thread/setDefaultUncaughtExceptionHandler
   (fn [thread ex]
+    ;; Integrant exceptions include component configuration in ex-data. Logging
+    ;; the exception object can therefore disclose database or cookie secrets.
     (log/error {:what            :uncaught-exception
-                :exception ex
-                :where (str "Uncaught exception on" (.getName thread))})))
+                :exception-class (.getName (class ex))
+                :message         (.getMessage ex)
+                :where           (str "Uncaught exception on " (.getName thread))})))
 
 
 (defonce system (atom nil))

test/clj/pmagnus/elprice/core_test.clj

@@ -3,5 +3,6 @@
     [clojure.test :refer [deftest is]]
     [pmagnus.elprice.core :as core]))
 
+
 (deftest system-state-is-managed-in-an-atom
   (is (instance? clojure.lang.Atom core/system)))