apache / apache/gravitino

[BUG] Error responses include a Java stack trace by default

Closed
#12,728 5 comments 0 reactions 1 assignee Claimed by @nevzheng View on GitHub
bug
Dominant language
Java
Stars
3.2k
Forks
935
Avg merge
1d 16h
Merged PRs (30d)
298

Description

Every error response carries a `stack` array containing internal class names, line numbers and proxy class names, and it is returned to unauthenticated callers.

Reproduce:

```
curl -s 'http://:8090/api/metalakes/zz/objects/table/a.b.c/tags'
```

Response includes:

```json
{"code":1008,"type":"ForbiddenException",
"message":"Current user anonymous doesn't exist in the metalake zz, you should add the user to the metalake first",
"stack":["org.apache.gravitino.exceptions.ForbiddenException: Current user anonymous doesn't exist in the metalake zz",
"\tat org.apache.gravitino.authorization.AuthorizationUtils.checkCurrentUser(AuthorizationUtils.java:131)",
"\tat org.apache.gravitino.server.web.filter.GravitinoInterceptionService$MetadataAuthorizationMethodInterceptor.invoke(GravitinoInterceptionService.java:168)",
"\tat org.jvnet.hk2.internal.MethodInterceptorHandler.invoke(MethodInterceptorHandler.java:97)",
"\tat org.apache.gravitino.server.web.rest.MetadataObjectTagOperations_$$_jvst95f_10.listTagsForMetadataObject(...)"]}
```

The `code`, `type` and `message` fields already give a client everything it needs to handle the error. The stack exposes internal class structure, line numbers and the hk2 and javassist proxy chain to any caller, including an unauthenticated one, and it is what the Enterprise UI currently renders in an error toast.

Required: the stack is omitted from error responses by default, and is included only when an explicit server setting enables it.

Observed on every error path in a sweep of all 130 `/metalakes` endpoints, build 1.3.0-SNAPSHOT, commit 6d9d432df18a9bd124c162ea50a296f436549980.

Required: fixed upstream in apache/gravitino and present in the enterprise tree before RC2 on September 4.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.