crossbario / crossbario/autobahn-python

Hide unexpected exceptions

Open
#609 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

needs-discussion
Dominant language
Python
Stars
2.5k
Forks
768
PR merge metrics
No merged PRs in 30d

Description

Currently any exception raised in e.g a endpoint will be reported back with its error message to the caller. I consider it really bad, that a caller might receives back sqlalchemy.exc.OperationalError: (_mysql_exceptions.OperationalError) (1045, "Access denied for user 'abc'@'localhost' (using password: NO)").

I propose that any exception which is not a or deriving from ApplicationError or which is not mapped to an uri, should report back something similiar like a HTTP 500 error. In particular: If we go into this branch protocol.py#L157, the error message should be replaced with something like "Internal server error".

So any exception deriving from ApplicationError or which has been registered with BaseSession.define will report back the actual error message just fine, but any unexpected exception will have it's error message hidden.

PS: A traceback should of course also not be transmitted in this case

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at autobahn/wamp/protocol.py around line 157 and inspect how unexpected exceptions are converted into responses. Check how ApplicationError and BaseSession.define mappings are handled, then verify that unmapped exceptions return an internal-server-error response without exposing the exception message or traceback.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.