Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-07 01:46:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Address security privacy review findings

Browse source 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9c2eebc4-dcd5-4b85-8113-90772d818900
This commit is contained in:
Jesper Schulz-Wedde 2026-07-14 11:08:45 +02:00
parent ec8f891954
commit d8f372453c
8 changed files with 14 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
microsoft/knowledge/privacy/getlasterrortext-customer-content-in-errors.bad.al
View file

@ -5,7 +5,7 @@ codeunit 50209 "Privacy Sample GetLastError Bad"
AttachmentFailedErr: Label 'Attachment failed: %1', Comment = '%1 = underlying error';
begin
if not TryAddAttachment() then
Error(StrSubstNo(AttachmentFailedErr, GetLastErrorText(true)));
Error(StrSubstNo(AttachmentFailedErr, GetLastErrorText()));
end;
procedure AddAttachmentWithConcatenation()
@ -13,7 +13,7 @@ codeunit 50209 "Privacy Sample GetLastError Bad"
AttachmentFailedErr: Label 'Attachment failed: ';
begin
if not TryAddAttachment() then
Error(AttachmentFailedErr + GetLastErrorText(true));
Error(AttachmentFailedErr + GetLastErrorText());
end;
[TryFunction]

2
microsoft/knowledge/privacy/getlasterrortext-customer-content-in-errors.good.al
View file

@ -5,7 +5,7 @@ codeunit 50208 "Privacy Sample GetLastError Good"
AttachmentFailedErr: Label 'Failed to add the attachment: %1', Comment = '%1 = underlying error shown to the user';
begin
if not TryAddAttachment() then
Error(AttachmentFailedErr, GetLastErrorText(true));
Error(AttachmentFailedErr, GetLastErrorText());
end;
[TryFunction]

6
microsoft/knowledge/privacy/getlasterrortext-customer-content-in-errors.md
View file

@ -11,16 +11,16 @@ application-area: [all]
## Description
`GetLastErrorText()` can contain customer content such as field values, record keys, and file names. When it is passed as a substitution value to an `Error` whose first argument is a `Label` or `TextConst`, the label supplies the Error method trace telemetry message. If `StrSubstNo` or concatenation makes `GetLastErrorText()` part of the first argument, the actual dynamic string is not emitted as that telemetry message; telemetry uses generic guidance instead.
Parameterless `GetLastErrorText()` can contain customer content such as field values, record keys, and file names. The Boolean overload names its parameter `ExcludeCustomerContent`; passing `true` requests scrubbed text and is not the customer-content scenario covered here. When unsanitized error text is passed as a substitution value to an `Error` whose first argument is a `Label` or `TextConst`, the label supplies the Error method trace telemetry message.
## Best Practice
Use a generic label when the user does not need the underlying detail. If showing the detail is appropriate, put `%1` in a label and pass `GetLastErrorText()` as a separate argument. This preserves a useful static telemetry message while keeping the dynamic value out of the telemetry message field.
Use a generic label when the user does not need the underlying detail. If showing unsanitized detail is appropriate, put `%1` in a label and pass parameterless `GetLastErrorText()` as a separate argument. This preserves a useful static telemetry message while keeping the dynamic value out of the telemetry message field.
See sample: `getlasterrortext-customer-content-in-errors.good.al`.
## Anti Pattern
`Error(StrSubstNo(AttachmentFailedErr, GetLastErrorText(true)))` or `Error(AttachmentPrefixErr + GetLastErrorText(true))`. Both lose the static first argument and trigger AA0231; neither causes the composed text to be logged verbatim as the Error telemetry message.
`Error(StrSubstNo(AttachmentFailedErr, GetLastErrorText()))` or `Error(AttachmentPrefixErr + GetLastErrorText())`. Both lose the static first argument and trigger AA0231; neither causes the composed text to be logged verbatim as the Error telemetry message.
See sample: `getlasterrortext-customer-content-in-errors.bad.al`.