Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add error handling API #80

Closed
ntsim opened this issue Jan 14, 2020 · 1 comment
Closed

Add error handling API #80

ntsim opened this issue Jan 14, 2020 · 1 comment

Comments

@ntsim
Copy link

ntsim commented Jan 14, 2020

Currently this adapter does not provide any API to modify its error handling behaviour and by default it simply converts any Objection errors into a FeathersError.

Unfortunately, this leads to leakage of database details in the form of error messages that usually contain the SQL that Objection is trying to execute. This should be considered a security vulnerability as it can be potentially used by malicious actors.

As FeathersError strip out any information from the original error, it makes it difficult to intercept the error and determine its original Objection error type so that we can re-map the error message. The Objection docs essentially suggest this is what you should be doing: https://vincit.github.io/objection.js/recipes/error-handling.html

Interestingly, feathers-knex already offers an escape hatch that allows you to access the underlying original error: https://github.com/feathersjs-ecosystem/feathers-knex#error-handling
This could perhaps serve as the frame of reference for where the API should go.

@dekelev
Copy link
Member

dekelev commented Feb 1, 2020

Thanks @ntsim, I'm releasing v4.8.0 with update to the error handler.

@dekelev dekelev closed this as completed Feb 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants