Uploaded image for project: 'Magnolia REST Framework'
  1. Magnolia REST Framework
  2. MGNLREST-132

Response includes JCR query error if the query has an error

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 2.0.2
    • None
    • None
    • None
    • Saigon 127, Saigon 128, Saigon 129, Saigon 130
    • 1

    Description

      The endpoint should not return the query exception. This is a security problem, as it reveals too much about how the system is working. It will also be unexpected by a developer, and reduce trust in the system. (Its OK for it to show up in the logs.)

      For example:
      http://localhost:8080/magnoliaAuthor/.rest/delivery/stories/v1?tours=a358f3ad-5a03-4f5d-b0ab-cb2219100472&820a075a-8c95-4f00-b0ee-5f3bf339f1ff

      Returns the text:
      "javax.jcr.query.InvalidQueryException: Query:
      SELECT * FROM [nt:base] AS t WHERE ([jcr:primaryType] = 'mgnl:composition') AND ([820a075a(*)-8c95-4f00-b0ee-5f3bf339f1ff] = '') AND ([tours] = 'a358f3ad-5a03-4f5d-b0ab-cb2219100472') ORDER BY LOWER(NAME(t)) ASC; expected: ]"

      Another example - if i request an endpoint it cannot find "http://localhost:8080/magnoliaAuthor/.rest/delivery/tours"
      I get response "RESTEASY003210: Could not find resource for full path: http://localhost:8080/magnoliaAuthor/.rest/delivery/tours" which I should not get.

      Checklists

        Acceptance criteria

        Attachments

          Issue Links

            Activity

              People

                hieu.nguyen Hieu Nguyen Duc
                czimmermann Christopher Zimmermann
                Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  Checklists

                    Bug DoR
                    Task DoD

                    Time Tracking

                      Estimated:
                      Original Estimate - 1d Original Estimate - 1d
                      1d
                      Remaining:
                      Remaining Estimate - 0d
                      0d
                      Logged:
                      Time Spent - 1d 0.5h
                      1d 0.5h