Skip to content

Do not expose internal exception details in GraphQL  #2199

Description

@luizm

The GraphQL API currently returns internal exception details to clients. I think the response should be sanitized

Example

feign.graphql.GraphqlErrorException: GraphQL backendRuntimeDefaultConfig operation failed: [{message=Exception while fetching data (/backendRuntimeDefaultConfig) : An error: (java.util.concurrent.CompletionException: javax.security.sasl.SaslException: Failed to find AWS IAM Credentials [Caused by software.amazon.awssdk.core.exception.SdkClientException: Received an UnknownHostException when attempting to interact with a service. See cause for the exact endpoint that is failing to resolve. If this is happening on an endpoint that previously worked, there may be a network connectivity issue or your DNS cache could be storing endpoints for too long.]) occurred when evaluating SASL token received from the Kafka Broker. Kafka Client will go to AUTHENTICATION_FAILED state., locations=[{line=2, column=5}], path=[backendRuntimeDefaultConfig], extensions={classification=DataFetchingException}}]
	at feign.graphql.GraphqlDecoder.doDecode(GraphqlDecoder.java:73)
	at feign.graphql.GraphqlDecoder.decode(GraphqlDecoder.java:48)
	at feign.InvocationContext.decode(InvocationContext.java:121)
	at feign.InvocationContext.proceed(InvocationContext.java:94)
	at feign.ResponseHandler.handleResponse(ResponseHandler.java:69)
	at feign.SynchronousMethodHandler.executeAndDecode(SynchronousMethodHandler.java:109)
	at feign.SynchronousMethodHandler.invoke(SynchronousMethodHandler.java:53)
	at io.github.resilience4j.retry.Retry.lambda$decorateCheckedFunction$3(Retry.java:226)
	at io.github.resilience4j.feign.DecoratorInvocationHandler.invoke(DecoratorInvocationHandler.java:95)
	at jdk.proxy2/jdk.proxy2.$Proxy59.backendRuntimeDefaultConfig(Unknown Source)
	at com.datasqrl.backend.BackendApiProducer_ProducerMethod_backendGraphqlApi_vpNTr8qQoelpIK7jmgIltNixA4Y_ClientProxy.backendRuntimeDefaultConfig(Unknown Source)
	at com.datasqrl.backend.GuardedBackendClient.backendRuntimeDefaultConfig(GuardedBackendClient.java:92)
	at com.datasqrl.backend.GuardedBackendClient_ClientProxy.backendRuntimeDefaultConfig(Unknown Source)
	at com.datasqrl.kubedeploy.steps.SaveDeploymentConfiguration.execute(SaveDeploymentConfiguration.java:47)
	at com.datasqrl.kubedeploy.steps.SaveDeploymentConfiguration_ClientProxy.execute(Unknown Source)
	at com.datasqrl.kubedeploy.DeploymentProcessor.doProcess(DeploymentProcessor.java:111)
	at com.datasqrl.kubedeploy.DeploymentProcessor.process(DeploymentProcessor.java:78)
	at com.datasqrl.kubedeploy.DeploymentProcessor_Subclass.process$$superforward(Unknown Source)
	at com.datasqrl.kubedeploy.DeploymentProcessor_Subclass$$function$$1.apply(Unknown Source)
	at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:73)
	at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:62)
	at io.quarkus.arc.impl.ActivateRequestContextInterceptor.invoke(ActivateRequestContextInterceptor.java:129)
	at io.quarkus.arc.impl.ActivateRequestContextInterceptor.aroundInvoke(ActivateRequestContextInterceptor.java:33)
	at io.quarkus.arc.impl.ActivateRequestContextInterceptor_Bean.intercept(Unknown Source)
	at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
	at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:30)
	at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:27)
	at com.datasqrl.kubedeploy.DeploymentProcessor_Subclass.process(Unknown Source)
	at com.datasqrl.kubedeploy.DeploymentProcessor_ClientProxy.process(Unknown Source)
	at com.datasqrl.kubedeploy.KubeDeployService.lambda$schedule$0(KubeDeployService.java:176)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:328)
	at java.base/java.util.concurrent.ThreadPerTaskExecutor$ThreadBoundFuture.run(ThreadPerTaskExecutor.java:323)
	at java.base/java.lang.VirtualThread.run(VirtualThread.java:456)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions