graphql-python / graphql-python/graphql-core-legacy
Error masking and internals leaking in error handling
- Vorherrschende Sprache
- Python
- Sterne
- 372
- Forks
- 175
- PR-Merge-Kennzahlen
- Keine gemergten PRs in 30 T.
Beschreibung
There are several places ([`execute_graphql()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/graphql.py#L72), [`complete_value()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L530), [`complete_value_catching_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L489), [`resolve_or_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L448), [`execute()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L128) [`ExecutionContext.report_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/utils.py#L152), may be there is more) where the library indiscriminately catches all exceptions and reports them to client. It's correct behaviour for parsing/usage errors. But for programming and runtime errors there are problems:
- original error is lost and traceback is not reported, so it becomes hard to debug;
- potentially sensitive information is leaked to client via error message.
I believe the the right behaviour would be to catch and report to client specific exceptions only (`GraphQLError` and subclasses?) while propagating the rest.
Related issues:
- [Unable to locate original location of Exception #207](https://github.com/graphql-python/graphql-core/issues/207)
- [Exception traceback disappears when running middleware #208](https://github.com/graphql-python/graphql-core/issues/208)
- [Use exc_info keyword when logging an exception. #165](https://github.com/graphql-python/graphql-core/pull/165)
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Rechercherichtung
Start by tracing exception handling through execute_graphql(), execute(), resolve_or_error(), complete_value_catching_error(), complete_value(), and ExecutionContext.report_error(). Read the linked issues for related traceback and logging behavior, then define and verify which exceptions are reported to clients, which propagate, and how original traceback information is preserved without exposing sensitive details.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- python
- Bereich
- api
- Issue-Typ
- Bug
- Schwierigkeit
- 5/5
- Geschätzter Aufwand
- Über eine Woche
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 30/100