graphql-python / graphql-python/graphql-core-legacy

Error masking and internals leaking in error handling

Offen
#209 3 Kommentare 3 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Python
Sterne
372
Forks
175
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

There are several places ([`execute_graphql()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/graphql.py#L72), [`complete_value()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L530), [`complete_value_catching_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L489), [`resolve_or_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L448), [`execute()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L128) [`ExecutionContext.report_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/utils.py#L152), may be there is more) where the library indiscriminately catches all exceptions and reports them to client. It's correct behaviour for parsing/usage errors. But for programming and runtime errors there are problems:

- original error is lost and traceback is not reported, so it becomes hard to debug;
- potentially sensitive information is leaked to client via error message.

I believe the the right behaviour would be to catch and report to client specific exceptions only (`GraphQLError` and subclasses?) while propagating the rest.

Related issues:

- [Unable to locate original location of Exception #207](https://github.com/graphql-python/graphql-core/issues/207)
- [Exception traceback disappears when running middleware #208](https://github.com/graphql-python/graphql-core/issues/208)
- [Use exc_info keyword when logging an exception. #165](https://github.com/graphql-python/graphql-core/pull/165)

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Rechercherichtung

Start by tracing exception handling through execute_graphql(), execute(), resolve_or_error(), complete_value_catching_error(), complete_value(), and ExecutionContext.report_error(). Read the linked issues for related traceback and logging behavior, then define and verify which exceptions are reported to clients, which propagate, and how original traceback information is preserved without exposing sensitive details.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
python
Bereich
api
Issue-Typ
Bug
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
30/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.