Repository navigation
Return no exception text or traceback from the FastAPI error handlers - #364
Merged
Merged
Conversation
With DEBUG=True, base_api_exception_handler added the traceback and unhandled_exception_handler added the exception type, message and traceback to the JSON response (CodeQL py/stack-trace-exposure, alerts 125-128). Both reference apps now return the documented error body only: error, message, status_code, details where the exception has them, and request_id, with the X-Request-ID header. The traceback goes to the server log: the unhandled handler already logged it, and the base handler now logs it when DEBUG is set. New tests in both apps raise an exception and call each handler inside the except block, with DEBUG on and off, and check that the body holds no exception text or traceback, that it matches the documented schema, and that the detail reaches the log. With the old handlers, the five DEBUG=True cases fail. The two existing unit tests that required a traceback in DEBUG mode now require its absence. The API-first app had no tests; CI now runs its tests directory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the four CodeQL py/stack-trace-exposure alerts (#125, #126, #127, #128) in both FastAPI reference apps.
base_api_exception_handlerandunhandled_exception_handlerno longer add adebugobject (exception type, message, traceback) to the response whenDEBUG=True. The body is the documented error schema withrequest_id, plus theX-Request-IDheader; status codes are unchanged.exc_info; the base handler now logs it whenDEBUGis set.tests/test_exception_handlers_no_leak.pyin both apps (12 tests each). With the old handlers the fiveDEBUG=Truecases failed because the body carried the exception text and traceback, and the base handler logged no traceback.Local results: FastAPI unit tests 193 passed, 52 skipped, 44 deselected (was 181/52/44), coverage 81.30%; API-first 12 passed. ruff-format reformatted the touched Python files, as the pre-commit hook requires.