OWASP / OWASP/OpenCRE

REST 404s return generic "Resource Not found" and drop abort() descriptions

Open
#1,020 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
180
Forks
137
Avg merge
3d 23h
Merged PRs (30d)
21

Description

Issue

What is the issue?

application/web/web_main.py registers a global 404 handler that always returns the plain string "Resource Not found". Flask abort(404, "…") descriptions never reach the client.

That includes abort(404, "No such Cache") on production/Heroku map_analysis cache miss, and abort(404, "No object matches the given search terms") on empty text_search.

The Gap Analysis UI reads e.response.data.message. For a string body that field is missing, so the page shows axios’s generic “Request failed with status code 404”.

abort(400/401/503) are unaffected (no custom handlers).

Expected Behaviour

A REST abort(404, "No such Cache") should surface that text to API clients, e.g. JSON {"message": "No such Cache"} for /rest/v1/*. Non-API 404s can stay a simple page.

Actual Behaviour

Every 404 body is "Resource Not found".

Steps to reproduce
  1. Flask test client, HEROKU=True, cache miss:
    GET /rest/v1/map_analysis?standard=OpenCRE&standard=NIST%20800-53%20v5
  2. Status is 404 (existing test already checks this).
  3. Body is "Resource Not found", not "No such Cache".

Same wipe: GET /rest/v1/text_search?text=no-such-term → 404 "Resource Not found".

Success criteria

  • /rest/v1/* 404 responses include the abort() description (JSON message is enough for the Gap Analysis UI).
  • Test asserts Heroku/cache-miss map_analysis body contains No such Cache.
  • make lint / make mypy / make test green.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read application/web/web_main.py and inspect the global 404 handler alongside the REST routes that call abort(404). Run the existing Heroku/cache-miss map_analysis test and the text_search case, then add or update assertions so REST 404 responses include the abort description while non-API 404 behavior remains covered; finish by running make lint, make mypy, and make test.

Written by the indexing model from the issue text.

Assessment

Tech stack
flask, python
Domain
api, backend, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.