Mojira Archive
WEB-1082

API leaks some information in exception messages

The problem

I am not sure how critical this problem is, but the API leaks some information like class names and which classes are used to parse which fields in the exception messages.

Examples

POSTing invalid JSON data to https://api.mojang.com/user/profiles/agent/minecraft (requires authentication) returns

{"error":"MismatchedInputException","errorMessage":"Cannot deserialize instance of `com.mojang.yggdrasil.accounts.users.profiles.ProfileCriteria` out of START_ARRAY token\n at [Source: (org.eclipse.jetty.server.HttpInputOverHTTP); line: 1, column: 1]"}

POSTing no content to https://api.mojang.com/user:

{"error":"IllegalArgumentException","errorMessage":"registration is marked @NonNull but is null"}

PUTting invalid values to https://api.mojang.com/user

{"error":"InvalidFormatException","errorMessage":"Cannot deserialize value of type `com.mojang.yggdrasil.accounts.users.User$EmailSubscriptionStatus` from String \"TEST\": value not one of declared Enum instance names: [DENIED, ACCEPTED, PENDING]\n at [Source: (org.eclipse.jetty.server.HttpInputOverHTTP); line: 1, column: 45] (through reference chain: com.mojang.yggdrasil.accounts.users.User[\"emailSubscriptionStatus\"])"}

Awaiting Response

Marcono1234

[Mojang] Web Team

2018-07-16, 10:47 PM

2022-12-06, 05:03 PM

2022-12-06, 05:03 PM

0

1