The exception response has been turned into text/plain last year for the purpose of security (SA-CORE-2016-004). For this reason HTML entities are now shown unprocessed. I propose we strip out HTML tags and decode special chars to make the error messages more readable.

Before:

The website encountered an unexpected error. Please try again later.</br></br><em class="placeholder">LogicException</em>: The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller? in <em class="placeholder">Symfony\Component\HttpKernel\HttpKernel-&gt;handleRaw()</em> (line <em class="placeholder">171</em> of <em class="placeholder">vendor/symfony/http-kernel/HttpKernel.php</em>). <pre class="backtrace">Symfony\Component\HttpKernel\HttpKernel-&gt;handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session-&gt;handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle-&gt;handle(Object, 1, 1) (Line: 99)
Drupal\page_cache\StackMiddleware\PageCache-&gt;pass(Object, 1, 1) (Line: 78)
Drupal\page_cache\StackMiddleware\PageCache-&gt;handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware-&gt;handle(Object, 1, 1) (Line: 50)
Drupal\Core\StackMiddleware\NegotiationMiddleware-&gt;handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel-&gt;handle(Object, 1, 1) (Line: 656)
Drupal\Core\DrupalKernel-&gt;handle(Object) (Line: 19)
</pre>

After:

The website encountered an unexpected error. Please try again later.

LogicException: The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller? in Symfony\Component\HttpKernel\HttpKernel->handleRaw() (line 171 of vendor/symfony/http-kernel/HttpKernel.php).

Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 99)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 78)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 50)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 656)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)
CommentFileSizeAuthor
#47 2872571-47.patch7.75 KBravi.shankar
#38 interdiff-2872571-36-38.txt618 bytesyogeshmpawar
#38 2872571-38.patch7.79 KByogeshmpawar
#36 interdiff-2872571-34-36.txt1.12 KByogeshmpawar
#36 2872571-36.patch7.5 KByogeshmpawar
#34 2872571-34.patch7.3 KByogeshmpawar
#27 exception_message_formatting-2872571-27.patch7.2 KBChi
#25 Screen Shot 2018-10-26 at 07.43.09.png809.8 KBalexpott
#23 exception_message_formatting-2872571-23.patch9.72 KBChi
#19 exception_message_formatting-2872571-19.patch9.77 KBChi
#15 interdiff-10-15.patch1.17 KBChi
#15 exception_message_formatting-2872571-15.patch9.77 KBChi
#10 interdiff-9-10.patch974 bytesChi
#10 exception_message_formatting-2872571-10.patch10 KBChi
#9 interdiff-7-9.patch1.01 KBChi
#9 exception_message_formatting-2872571-9.patch9.6 KBChi
#7 exception_message_formatting-2872571-7.patch9.36 KBChi
#4 exception_message_formatting-2872571-4.patch10.86 KBChi
#2 exception_message_formatting-2872571-2.patch827 bytesChi
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Chi created an issue. See original summary.

Chi’s picture

The fix is pretty simple.

Status: Needs review » Needs work

The last submitted patch, 2: exception_message_formatting-2872571-2.patch, failed testing.

Chi’s picture

The change also simplifies a bit testing HTTP exceptions.

Chi’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 4: exception_message_formatting-2872571-4.patch, failed testing. View results

Chi’s picture

Status: Needs work » Needs review
FileSize
9.36 KB

Reroll.

dawehner’s picture

It is interesting that \Drupal\Component\Render\PlainTextOutput::renderFromHtml does something similar, but not the same.

Chi’s picture

Well maybe we should use it then.

Chi’s picture

There is no point to format backtrace with HTML.

Chi’s picture

Issue summary: View changes

The last submitted patch, 9: exception_message_formatting-2872571-9.patch, failed testing. View results

The last submitted patch, 10: exception_message_formatting-2872571-10.patch, failed testing. View results

dawehner’s picture

This is all some legacy code inherited from the days when we tried to render exceptions in a drupal themed way.

Chi’s picture

PlainTextOutput in some cases may return HTML which is not need when rendering exception.
This patch discards changes made in #9.

Status: Needs review » Needs work

The last submitted patch, 15: interdiff-10-15.patch, failed testing. View results

Chi’s picture

Status: Needs work » Needs review

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Chi’s picture

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Status: Needs review » Needs work

The last submitted patch, 19: exception_message_formatting-2872571-19.patch, failed testing. View results

Chi’s picture

joachim’s picture

Status: Needs review » Reviewed & tested by the community
alexpott’s picture

Issue summary: View changes
Status: Reviewed & tested by the community » Needs work
FileSize
809.8 KB
  1. +++ b/core/lib/Drupal/Core/EventSubscriber/FinalExceptionSubscriber.php
    @@ -119,12 +119,14 @@ public function onException(GetResponseForExceptionEvent $event) {
    -        $message = new FormattableMarkup('%type: @message in %function (line %line of %file). <pre class="backtrace">@backtrace</pre>', $error);
    +        $message = new FormattableMarkup("%type: @message in %function (line %line of %file).\n\n@backtrace", $error);
    

    I'm wondering about removing the class and pre tags. Does this impact devel? I.e do we need a change record?

  2. +++ b/core/lib/Drupal/Core/EventSubscriber/FinalExceptionSubscriber.php
    @@ -119,12 +119,14 @@ public function onException(GetResponseForExceptionEvent $event) {
    +      $content .= "\n\n" . strip_tags(htmlspecialchars_decode($message, ENT_QUOTES));
    

    I think we should use \Drupal\Component\Render\PlainTextOutput::renderFromHtml() here - so we standardise on how we convert HTML to plain text.

  3. Also where are you seeing the HTML. If a look at an exception in the browser it looks like this
    Screenshot of exception

    So are we fixing this on the right level - if you're seeing this in Drush or Console I think they should problem fix this.
Chi’s picture

Also where are you seeing the HTML. If a look at an exception in the browser it looks like this

@alexpott, because it is not an exception but TypeError. I suppose FinalExpceptionSubscriber does not handle such kind of errors.

Does this impact devel?

I don't know how this is related to Devel module. Could you please explain possible implications?

Status: Needs review » Needs work

The last submitted patch, 27: exception_message_formatting-2872571-27.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

Chi’s picture

Status: Needs work » Needs review
jhedstrom’s picture

Title: Make the output of final exception subscriber developer firendly » Make the output of final exception subscriber developer friendly

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Chi’s picture

Status: Needs review » Needs work
Issue tags: +Needs reroll
yogeshmpawar’s picture

Assigned: Unassigned » yogeshmpawar
yogeshmpawar’s picture

Assigned: yogeshmpawar » Unassigned
Status: Needs work » Needs review
Issue tags: -Needs reroll
FileSize
7.3 KB

Re-rolled the patch #27.

alexpott’s picture

Status: Needs review » Needs work

Since #2924860: “Uncaught exception” page contains HTML but has content-type text/plain landed this is now making the the output less not more developer friendly. I think we we should consider doing something like:

    $content = $this->t('The website encountered an unexpected error. Please try again later.');
    if ($event->getRequest()->getRequestFormat() == 'html') {
      $content .= $message ? '<br/><br/>' . $message : '';
      $content_type = 'text/html';
    }
    else {
      $content .= $message ? "\n\n" . strip_tags(PlainTextOutput::renderFromHtml($message)) : '';
      $content_type = 'text/plain';
    }
    $response = new Response($content, 500, ['Content-Type' => $content_type]);

That way html output gets all the advantage of html and properly escaped errors and plain output looks good but has all HTML tags removed for the error message as we cannot be sure about the context it might be displayed it.

yogeshmpawar’s picture

Status: Needs work » Needs review
FileSize
7.5 KB
1.12 KB

Comments addressed in #35 & added an interdiff.

Status: Needs review » Needs work

The last submitted patch, 36: 2872571-36.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

yogeshmpawar’s picture

Status: Needs work » Needs review
FileSize
7.79 KB
618 bytes

Missed to include use Drupal\Component\Render\PlainTextOutput; in patch. Updated patch added with an interdiff.

Status: Needs review » Needs work

The last submitted patch, 38: 2872571-38.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

jjwfcd’s picture

is this issue make the taxonomy term view page down related
?

The website encountered an unexpected error. Please try again later.LogicException: The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller? in Symfony\Component\HttpKernel\HttpKernel->handleRaw() (line 169 of /webroot/vendor/symfony/http-kernel/HttpKernel.php).

2019/07/07 05:05:46 [error] 30704#30704: *1582 FastCGI sent in stderr: "PHP message: Uncaught PHP Exception LogicException: "The controller must return a response (null given). Did you forget to add a return statement somewhere in your controller?" at /webroot/vendor/symfony/http-kernel/HttpKernel.php line 169" while reading response header from upstream, client: 111.222.122.122, server: abc.doamin, request: "GET /taxonomy/term/10318 HTTP/2.0", upstream: "fastcgi://127.0.0.1:9999", host: "abc.domain"

with drupal core 8.7.4 and distribution varbase

https://www.drupal.org/project/varbase/issues/3066163

jjwfcd’s picture

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

APolitsin’s picture

негодуэ
Subscribe

ravi.shankar’s picture

Assigned: Unassigned » ravi.shankar
Chi’s picture

ravi.shankar’s picture

Here I have tried to add reroll of patch #38 for Drupal 9.1.x.

ravi.shankar’s picture

Assigned: ravi.shankar » Unassigned

Status: Needs review » Needs work

The last submitted patch, 47: 2872571-47.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.