exception handling

[boutell]

Summary

Proper exception handling, just in case, although I can't reproduce an exception reaching this point with the URLs the client suggested it is something middleware handlers should be doing

What are the specific steps to test this change?

Redirects work normally, non-redirects work normally

What kind of change does this PR introduce?

(Check at least one)

• Bug fix
• New feature
• Refactor
• Documentation
• Build-related changes
• Other

Make sure the PR fulfills these requirements:

• It includes a) the existing issue ID being resolved, b) a convincing reason for adding this feature, or c) a clear description of the bug it resolves
• The changelog is updated
• Related documentation has been updated
• Related tests have been updated

If adding a new feature without an already open issue, it's best to open a feature request issue first and wait for approval before working on it.

Other information:

[linear]

PRO-3502 As a bad actor I cannot crash Apostrophe just by supplying an invalid locale name in a URL

See:

https://gitlab-dcadcx.michelin.net/pa/apostrophe-enhancements/-/issues/1199

The language switcher generates technical urls like this: https://legal.connectedmobility.michelin.com/api/v1/@apostrophecms/page/clai269kt0y0701ox966n0xl5:en:published/locale/fr

If we put a bad locale at the end of this url, it makes all Assembly crash - we had this issue this morning in production where a Qualys scan made all servers crash.

https://legal.connectedmobility.michelin.com/api/v1/@apostrophecms/page/clai269kt0y0701ox966n0xl5:en:published/locale/toto -> crash

It's a pretty straightforward bug in the i18n module:

      toLocaleRouteFactory(module) {
        return async (req, res) => {
          const _id = module.inferIdLocaleAndMode(req, req.params._id);
          const toLocale = req.params.toLocale;
          const localeReq = req.clone({
            locale: toLocale
          });

And then other code cannot trust that req.locale is valid.
Solution is a check for a valid locale name here.

[myovchev]

The CircleCI error is probably related with outdated repo configuration.