Tech Debt: Verify no data leakage or XSS exploit

[Adrian Otto]

https://review.openstack.org/#/c/57023/18/solum/common/exception.py

Look at line 127 of the code above. After this code is merged, we need to revisit any dependent code that calls this function to be sure that whatever sets application_id is not user-supplied data without sensible data input validation. Because this is a "Not Found" type error, there will be no associated back-end data element id to return, so this will only ever be some form of user-supplied data.

We would not want to echo it to the screen, as that opens a security risk. This best practice prevents a category of XSS attacks for web based applications that might display this error as part of an HTML page. Any such value will need to be processed with sensible input validation before we can consider returning it in an error message. Something like an allowed set of characters... possibly /a-zA-Z0-9_ -/ (or the localized equivalent) and prohibiting all other characters (especially %&; and angle braces). Failure to pass input validation should result in something like an "invalid input" exception that does not return the illegal value back to the user, but instead lists the allowed characters.