'Does the ToString() method of the following concrete exception types yield sensitive data?

Despite searching exhaustively, I couldn´t find a discussion of the mentioned question. Please point me to the question if there´s any.

Now to my question. I´d like to log the output of the ToString() method of the following concrete exceptions (they aren´t custom exceptions, i.e., I didn´t write them myself) into a file:

  • ArgumentNullException
  • System.Exception itself
  • SecurityTokenException and exceptions that inherit from SecurityTokenException (e.g., SecurityTokenExpiredException)

Is it save to do so, i.e., doesn´t ToString() return senstive data that might have caused the exception in the first place?

According to the docs, System.Exception.ToString() returns the following output:

The default implementation of ToString obtains the name of the class that threw the current exception, the message, the result of calling ToString on the inner exception, and the result of calling Environment.StackTrace. If any of these members is null, its value is not included in the returned string.

Examining the Environment.Stacktrace yields (if I understood it correctly) the following information:

  • StackTrace doesn´t contain senstive data (only method parameter names not their values)
  • Name of the class is fine (no senstive data here!)
  • InnerEception.ToString() follows the definition of ToString() above. Hence, it should be fine too.

Does the Message property of the mentioned exceptions yield senstive data (e.g., parameter values, content of JwtSecurityToken etc.)? Can the pure unchanged output of the message proeprty be logged savely (I know there´s encryption but independent of that)?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source