Forms api - Mask all potential PII from error message

[gmrabian]

Following up on a recent incident where a JSON::ParserError displayed some PII when parsing an invalid payload - this surrounds the entire forms_api functionality, catches any errors, and raises them with every word entered by the user scrubbed from the message.

Summary

• Add rescue block to controller method
• Within rescue block, parse all values from the input and remove them from the error message

Related issue(s)

• https://app.zenhub.com/workspaces/vagov-product-team-forms-634853151f5c6000165942bc/issues/gh/department-of-veterans-affairs/va.gov-team-forms/217

Testing done

• Tested locally by manually throwing errors with various tests and payloads
• Successfully removed all user info and potential PII from error message.

Screenshots

Test payload example

BEFORE:

AFTER:

In the scrubbed example we still get the failed JSON blob's structure, and we can see some newlines, which were the cause of our issue. This is related to the issue we fixed that caused the PII dump.

What areas of the site does it impact?

All forms using the forms_api (currently only 26-4555)

Acceptance criteria

• I fixed|updated|added unit tests and integration tests for each feature (if applicable).
• No error nor warning in the console.
• Events are being sent to the appropriate logging solution
• Documentation has been updated (link to documentation)
• No sensitive information (i.e. PII/credentials/internal URLs/etc.) is captured in logging, hardcoded, or specs
• Feature/bug has a monitor built into Datadog or Grafana (if applicable)
• If app impacted requires authentication, did you login to a local build and verify all authenticated routes work as expected
• I added a screenshot of the developed feature

Requested Feedback

Is there a better way you would suggest catching/raising this error? I noticed the Common::Exceptions::etc. error patterns but did not have success implementing them, and this is meant to catch any error type.

[ryan-mcneil]

nice!