Repository: containerd/containerd
File: internal/cri/instrument/instrumented_service.go (Go)

Code before:
	if err := in.checkInitialized(); err != nil {
		return nil, err
	}
	log.G(ctx).Infof("UpdateContainerResources for %q with Linux: %+v / Windows: %+v", r.GetContainerId(), r.GetLinux(), r.GetWindows())
	defer func() {
		if err != nil {
			log.G(ctx).WithError(err).Errorf("UpdateContainerResources for %q failed", r.GetContainerId())
		} else {
			log.G(ctx).Infof("UpdateContainerResources for %q returns successfully", r.GetContainerId())
		}
	}()
	res, err = in.c.UpdateContainerResources(ctrdutil.WithNamespace(ctx), r)
	return res, errgrpc.ToGRPC(err)
}

func (in *instrumentedService) PullImage(ctx context.Context, r *runtime.PullImageRequest) (res *runtime.PullImageResponse, err error) {
	if err := in.checkInitialized(); err != nil {
		return nil, err
	}
	span := tracing.SpanFromContext(ctx)
	log.G(ctx).Infof("PullImage %q", r.GetImage().GetImage())
	defer func() {
		if err != nil {
			// Sanitize error to remove sensitive information
			sanitizedErr := ctrdutil.SanitizeError(err)
			log.G(ctx).WithError(sanitizedErr).Errorf("PullImage %q failed", r.GetImage().GetImage())
		} else {
			log.G(ctx).Infof("PullImage %q returns image reference %q",
				r.GetImage().GetImage(), res.GetImageRef())
		}
		span.RecordError(err)
	}()
	res, err = in.c.PullImage(ctrdutil.WithNamespace(ctx), r)
	return res, errgrpc.ToGRPC(err)
}

func (in *instrumentedService) ListImages(ctx context.Context, r *runtime.ListImagesRequest) (res *runtime.ListImagesResponse, err error) {
	if err := in.checkInitialized(); err != nil {
		return nil, err
	}
	log.G(ctx).Tracef("ListImages with filter %+v", r.GetFilter())
	defer func() {
		if err != nil {
			// Sanitize error to remove sensitive information
			sanitizedErr := ctrdutil.SanitizeError(err)
			log.G(ctx).WithError(sanitizedErr).Errorf("ListImages with filter %+v failed", r.GetFilter())
		} else {
			log.G(ctx).Tracef("ListImages with filter %+v returns image list %+v",
				r.GetFilter(), res.GetImages())
		}
	}()

Review comment (security):
It loos like this is fixing the logs but not the returned error.
Also needs to fix spans.
I think it should set `err = ctrdutil.SanitizeError(err)` instead of creating a new var.

Code after:
	if err := in.checkInitialized(); err != nil {
		return nil, err
	}
	log.G(ctx).Infof("UpdateContainerResources for %q with Linux: %+v / Windows: %+v", r.GetContainerId(), r.GetLinux(), r.GetWindows())
	defer func() {
		if err != nil {
			log.G(ctx).WithError(err).Errorf("UpdateContainerResources for %q failed", r.GetContainerId())
		} else {
			log.G(ctx).Infof("UpdateContainerResources for %q returns successfully", r.GetContainerId())
		}
	}()
	res, err = in.c.UpdateContainerResources(ctrdutil.WithNamespace(ctx), r)
	return res, errgrpc.ToGRPC(err)
}

func (in *instrumentedService) PullImage(ctx context.Context, r *runtime.PullImageRequest) (res *runtime.PullImageResponse, err error) {
	if err := in.checkInitialized(); err != nil {
		return nil, err
	}
	span := tracing.SpanFromContext(ctx)
	log.G(ctx).Infof("PullImage %q", r.GetImage().GetImage())
	defer func() {
		if err != nil {
			// Sanitize error to remove sensitive information
			err = ctrdutil.SanitizeError(err)
			log.G(ctx).WithError(err).Errorf("PullImage %q failed", r.GetImage().GetImage())
		} else {
			log.G(ctx).Infof("PullImage %q returns image reference %q",
				r.GetImage().GetImage(), res.GetImageRef())
		}
		span.RecordError(err)
	}()
	res, err = in.c.PullImage(ctrdutil.WithNamespace(ctx), r)
	return res, errgrpc.ToGRPC(err)
}

func (in *instrumentedService) ListImages(ctx context.Context, r *runtime.ListImagesRequest) (res *runtime.ListImagesResponse, err error) {
	if err := in.checkInitialized(); err != nil {
		return nil, err
	}
	log.G(ctx).Tracef("ListImages with filter %+v", r.GetFilter())
	defer func() {
		if err != nil {
			// Sanitize error to remove sensitive information
			err = ctrdutil.SanitizeError(err)
			log.G(ctx).WithError(err).Errorf("ListImages with filter %+v failed", r.GetFilter())
		} else {
			log.G(ctx).Tracef("ListImages with filter %+v returns image list %+v",
				r.GetFilter(), res.GetImages())
		}
	}()