Problem/Motivation

If an exception is thrown from a graphql query, the exception message is printed to all users.

Steps to reproduce

Create a custom graphql field plugin that, for example, makes an external HTTP request and doesn't catch GuzzleException. When the request fails, the message usually includes the full URL with possible sensitive (secret) URL parameters.

Proposed resolution

Instead of print() use watchdog_exception().

CommentFileSizeAuthor
#3 3219878-3.patch551 bytesolli
#2 3219878-2.patch567 bytesolli

Comments

olli created an issue. See original summary.

olli’s picture

olli commented
Status: Active » Needs review
StatusFileSize
new 3219878-2.patch567 bytes
olli’s picture

olli commented
Version: 8.x-1.x-dev » 4.x-dev
StatusFileSize
new 3219878-3.patch551 bytes

Here's an alternative for 4.x that prints errors only if twig debug mode is enabled.

  • olli authored bcdc2f93 on 4.x 
    Issue #3219878 by olli: Exceptions printed to all users

  • olli authored 9d119bea on 3.x 
    Issue #3219878 by olli: Exceptions printed to all users
3li’s picture

3li
he/him
Primary language English
Location U.K. 🇬🇧
commented
Status: Needs review » Fixed

Applied the $this->env->isDebug() fix to both 3.x & 4.x thank you.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.