graphql-python / graphql-python/graphql-core-legacy
Error masking and internals leaking in error handling
- Langage dominant
- Python
- Étoiles
- 372
- Forks
- 175
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
There are several places ([`execute_graphql()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/graphql.py#L72), [`complete_value()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L530), [`complete_value_catching_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L489), [`resolve_or_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L448), [`execute()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/executor.py#L128) [`ExecutionContext.report_error()`](https://github.com/graphql-python/graphql-core/blob/master/graphql/execution/utils.py#L152), may be there is more) where the library indiscriminately catches all exceptions and reports them to client. It's correct behaviour for parsing/usage errors. But for programming and runtime errors there are problems:
- original error is lost and traceback is not reported, so it becomes hard to debug;
- potentially sensitive information is leaked to client via error message.
I believe the the right behaviour would be to catch and report to client specific exceptions only (`GraphQLError` and subclasses?) while propagating the rest.
Related issues:
- [Unable to locate original location of Exception #207](https://github.com/graphql-python/graphql-core/issues/207)
- [Exception traceback disappears when running middleware #208](https://github.com/graphql-python/graphql-core/issues/208)
- [Use exc_info keyword when logging an exception. #165](https://github.com/graphql-python/graphql-core/pull/165)
Guide de contribution
Aucun guide de contribution indexé pour ce dépôt
Piste de recherche
Commencez par suivre la gestion des exceptions à travers execute_graphql(), execute(), resolve_or_error(), complete_value_catching_error(), complete_value() et ExecutionContext.report_error(). Lisez les issues liées concernant le comportement associé des tracebacks et du logging, puis définissez et vérifiez quelles exceptions sont signalées aux clients, lesquelles se propagent et comment les informations du traceback d’origine sont préservées sans exposer de détails sensibles.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- python
- Domaine
- api
- Type d'issue
- Bug
- Difficulté
- 5/5
- Temps estimé
- Plus d'une semaine
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 30/100