crossbario / crossbario/autobahn-python
Hide unexpected exceptions
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2.5k
- Forks
- 768
- PR merge metrics
- No merged PRs in 30d
Description
Currently any exception raised in e.g a endpoint will be reported back with its error message to the caller. I consider it really bad, that a caller might receives back sqlalchemy.exc.OperationalError: (_mysql_exceptions.OperationalError) (1045, "Access denied for user 'abc'@'localhost' (using password: NO)").
I propose that any exception which is not a or deriving from ApplicationError or which is not mapped to an uri, should report back something similiar like a HTTP 500 error. In particular: If we go into this branch protocol.py#L157, the error message should be replaced with something like "Internal server error".
So any exception deriving from ApplicationError or which has been registered with BaseSession.define will report back the actual error message just fine, but any unexpected exception will have it's error message hidden.
PS: A traceback should of course also not be transmitted in this case
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at autobahn/wamp/protocol.py around line 157 and inspect how unexpected exceptions are converted into responses. Check how ApplicationError and BaseSession.define mappings are handled, then verify that unmapped exceptions return an internal-server-error response without exposing the exception message or traceback.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100