1637163 - FxA WebChannel errors can contain personal info, such as profile directory path, that gets forwarded to sentry

Status: RESOLVED FIXED

(Firefox :: Firefox Accounts, defect)

Description

[Ryan Kelly [:rfkelly]]

Poking around in the sentry errors logged by accounts.firefox.com, I noticed a collection of errors with a message of the following form:

WebChannel error: Win error NN during operation rename on file FILE\PATH\signedInUser.json (specific error message in user's native locale)

Here are some examples of individual errors.

The FILE\PATH component of the message typically contains the user's windows account username, which might reasonably be considered PII, which I'm not sure we're comfortable sharing with a third-party service like sentry.

I think we should try to clean these up, both because of the personal information, and because having them in sentry as hundreds of slightly different error messages doesn't help us understand the prevalence of the underlying error. But it's not clear to me what code should be responsible for doing said cleanup. Should Firefox try to clean up error messages before returning them to accounts.firefox.com via the webchannel? Should FxA try to clean them up before forwarding to sentry?

Adding a few folks who may have opinions on the matter.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:markh, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Thom Chiovoloni [:tcsc] (ex-moco)]

In the sync telemetry ping, we strip this stuff out like this: https://searchfox.org/mozilla-central/source/services/sync/modules/telemetry.js#535-550 (the heavy lifting done by this regex https://searchfox.org/mozilla-central/source/services/sync/modules/telemetry.js#114, which admittely doesn't really need to be a regex so much as replacement).

Comment 3

[Ryan Kelly [:rfkelly]]

The function that generates the error string in this case is here:

• https://searchfox.org/mozilla-central/rev/7dafc35406b9c945189c617d427f5458933fd3fb/services/fxaccounts/FxAccountsWebChannel.jsm#119

So I think we could profitably add this bit of cleaning up in that location.

Comment 4

[Vlad Filippov (:vladikoff)]

Attachment: Bug 1637163 - Redact details in WebChannel errors. r=rfkelly

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b1113499383d
Redact details in WebChannel errors. r=rfkelly

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/b1113499383d