Warnings about "unable to parse form content" are not helpful for troubleshooting

[LIANGQI0811]

---

java version "1.8.0_291"
Linux/CentOS 7

Description

---

I noticed that org.eclipse.jetty.server.Request#getParameters

private MultiMap<String> getParameters()
{
if (!_contentParamsExtracted)
{
// content parameters need boolean protection as they can only be read
// once, but may be reset to null by a reset
_contentParamsExtracted = true;

            // Extract content parameters; these cannot be replaced by a forward()
            // once extracted and may have already been extracted by getParts() or
            // by a processing happening after a form-based authentication.
            if (_contentParameters == null)
            {
                try
                {
                    extractContentParameters();
                }
                catch (IllegalStateException | IllegalArgumentException e)
                {
                    throw new BadMessageException("Unable to parse form content", e);
                }
            }
        }
    .....
}

IllegalStateException will be decorated into BadMessageException
And the Exception Message will be BadMessageException's message.

This is unreasonable.I care about IllegalStateException's message instead of BadMessageException's message!

e.g.
if the body size exceed the limit,extractContentParameters() method will throw IllegalStateException with message Form is larger than max length xxx
and in org.eclipse.jetty.server.Request#getParameters#getParameters() will be be decorated into BadMessageException with message Unable to parse form content
log will print Unable to parse form content not Form is larger than max length xxx
Think Form is larger than max length xxx is more useful than Unable to parse form content

[LIANGQI0811]

jetty version: 9.4.35

[janbartel]

You probably don't want information about the server configuration (max form size) leaking to clients - could give attackers information.

[LIANGQI0811]

Of course, can we compromise? For example, print the detailed reason to the debug log

[LIANGQI0811]

Of course, ERROR log is better

[janbartel]

We could do Log.WARN level with the original message eg "Form is larger than max length xxx". This wouldn't be a full stack trace, as attackers can force this to happen and cause resources on the server to be exhausted (ie gigantic log files).

[LIANGQI0811]

very will,thanks for jetty project team!