call stack returned in odata response

Assemblies affected

Microsoft.AspNetCore.OData 7.2.1

Reproduce steps

In a non-development environment, if the odata stack invalidates an otherwise valid response, for example, if I did not specify “routes.MaxTop(null)” and there is a request coming in with “Top=100”, the response received by the caller will be something that looks like:

Id = 48, Status = RanToCompletion, Method = "{null}", Result = "{"error":{"code":"","message":"The query specified in the URI is not valid. The limit of '0' for Top query has been exceeded. The value from the incoming request is '100'.","details":[],"innererror":{"message":"The limit of '0' for Top query has been exceeded. The value from the incoming request is '100'.","type":"Microsoft.OData.ODataException","stacktrace":" at Microsoft.AspNet.OData.Query.Validators.TopQueryValidator.Validate(TopQueryOption topQueryOption, ODataValidationSettings validationSettings)\r\n at Microsoft.AspNet.OData.Query.Validators.ODataQueryValidator.Validate(ODataQueryOptions options, ODataValidationSettings validationSettings)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.ValidateQuery(HttpRequest request, ODataQueryOptions queryOptions)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.<>c__DisplayClass1_0.b__1(ODataQueryContext queryContext)\r\n at Microsoft.A
spNet.OData.EnableQueryAttribute.ExecuteQuery(Object responseValue, IQueryable singleResultCollection, IWebApiActionDescriptor actionDescriptor, Func2 modelFunction, IWebApiRequestMessage request, Func2 createQueryOptionFunction)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.OnActionExecuted(Object responseValue, IQueryable singleResultCollection, IWebApiActionDescriptor actionDescriptor, IWebApiRequestMessage request, Func2 modelFunction, Func2 createQueryOptionFunction, Action1 createResponseAction, Action3 createErrorAction)"}}}"
AsyncState: null
CancellationPending: false
CreationOptions: None
Exception: null
Id: 48
Result: "{"error":{"code":"","message":"The query specified in the URI is not valid. The limit of '0' for Top query has been exceeded. The value from the incoming request is '100'.","details":[],"innererror":{"message":"The limit of '0' for Top query has been exceeded. The value from the incoming request is '100'.","type":"Microsoft.OData.ODataException","stacktrace":" at Microsoft.AspNet.OData.Query.Validators.TopQueryValidator.Validate(TopQueryOption topQueryOption, ODataValidationSettings validationSettings)\r\n at Microsoft.AspNet.OData.Query.Validators.ODataQueryValidator.Validate(ODataQueryOptions options, ODataValidationSettings validationSettings)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.ValidateQuery(HttpRequest request, ODataQueryOptions queryOptions)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.<>c__DisplayClass1_0.b__1(ODataQueryContext queryContext)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.ExecuteQuery(Objec
t responseValue, IQueryable singleResultCollection, IWebApiActionDescriptor actionDescriptor, Func2 modelFunction, IWebApiRequestMessage request, Func2 createQueryOptionFunction)\r\n at Microsoft.AspNet.OData.EnableQueryAttribute.OnActionExecuted(Object responseValue, IQueryable singleResultCollection, IWebApiActionDescriptor actionDescriptor, IWebApiRequestMessage request, Func2 modelFunction, Func2 createQueryOptionFunction, Action1 createResponseAction, Action3 createErrorAction)"}}}"
Status: RanToCompletion

As you can see, the call stack is included in the response. Could we avoid having call stacks exposed to the caller?

Expected result

Call stacks shall not be returned

Actual result

call stack is exposed

Additional detail

Optional, details of the root cause if known. Delete this section if you have no additional details to add.

Start by reproducing the non-development OData validation failure described in the issue, then trace the error handling through EnableQueryAttribute.ValidateQuery and OnActionExecuted. Check how the OData error response populates innererror.stacktrace. Done means validation errors no longer expose call stacks to callers while retaining the expected error message.