[BUG] Error responses include a Java stack trace by default
- Dominant language
- Java
- Stars
- 3.2k
- Forks
- 935
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 298
Description
Every error response carries a `stack` array containing internal class names, line numbers and proxy class names, and it is returned to unauthenticated callers.
Reproduce:
```
curl -s 'http://:8090/api/metalakes/zz/objects/table/a.b.c/tags'
```
Response includes:
```json
{"code":1008,"type":"ForbiddenException",
"message":"Current user anonymous doesn't exist in the metalake zz, you should add the user to the metalake first",
"stack":["org.apache.gravitino.exceptions.ForbiddenException: Current user anonymous doesn't exist in the metalake zz",
"\tat org.apache.gravitino.authorization.AuthorizationUtils.checkCurrentUser(AuthorizationUtils.java:131)",
"\tat org.apache.gravitino.server.web.filter.GravitinoInterceptionService$MetadataAuthorizationMethodInterceptor.invoke(GravitinoInterceptionService.java:168)",
"\tat org.jvnet.hk2.internal.MethodInterceptorHandler.invoke(MethodInterceptorHandler.java:97)",
"\tat org.apache.gravitino.server.web.rest.MetadataObjectTagOperations_$$_jvst95f_10.listTagsForMetadataObject(...)"]}
```
The `code`, `type` and `message` fields already give a client everything it needs to handle the error. The stack exposes internal class structure, line numbers and the hk2 and javassist proxy chain to any caller, including an unauthenticated one, and it is what the Enterprise UI currently renders in an error toast.
Required: the stack is omitted from error responses by default, and is included only when an explicit server setting enables it.
Observed on every error path in a sweep of all 130 `/metalakes` endpoints, build 1.3.0-SNAPSHOT, commit 6d9d432df18a9bd124c162ea50a296f436549980.
Required: fixed upstream in apache/gravitino and present in the enterprise tree before RC2 on September 4.
Contributor guide
Assessment
This issue has not been assessed yet.