fix(workflows): Treat OrganizationWorkflowIndexEndpoint query parse errors as 400s#110434
fix(workflows): Treat OrganizationWorkflowIndexEndpoint query parse errors as 400s#110434
Conversation
github-actions
bot
added
the
Scope: Backend
saponifi3d
left a comment
saponifi3d
left a comment
There was a problem hiding this comment.
best pr since sliced bread.
| if raw_query := request.GET.get("query"): | ||
| for filter in parse_workflow_query(raw_query): | ||
| try: | ||
| parsed_query = parse_workflow_query(raw_query) |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| try: | ||
| parsed_query = parse_workflow_query(raw_query) | ||
| except InvalidSearchQuery as e: | ||
| raise serializers.ValidationError({"query": [str(e)]}) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix this, we should stop returning the raw InvalidSearchQuery exception message to the client and instead send a generic, user-safe validation error while logging or otherwise handling the detailed error server-side if needed. The key is to preserve behavior (a 400 with an error on the query field) while ensuring the message is not derived from the exception text.
Concretely, in OrganizationWorkflowIndexEndpoint.filter_workflows, change the except InvalidSearchQuery as e: block so that it no longer uses str(e) in the response. Replace:
except InvalidSearchQuery as e:
raise serializers.ValidationError({"query": [str(e)]})with a version that uses a static message, such as:
except InvalidSearchQuery:
raise serializers.ValidationError(
{"query": ["Invalid search query. Check the syntax and supported fields."]}
)This keeps the same structure of the validation error (field key query, list of messages) and the same exception type, so existing client handling should continue to work, but no longer leaks exception-derived details. No new imports are required, and no other parts of the file need to change for this fix.
| @@ -164,8 +164,14 @@ | ||
| if raw_query := request.GET.get("query"): | ||
| try: | ||
| parsed_query = parse_workflow_query(raw_query) | ||
| except InvalidSearchQuery as e: | ||
| raise serializers.ValidationError({"query": [str(e)]}) | ||
| except InvalidSearchQuery: | ||
| raise serializers.ValidationError( | ||
| { | ||
| "query": [ | ||
| "Invalid search query. Check the query syntax and supported fields." | ||
| ] | ||
| } | ||
| ) | ||
| for filter in parsed_query: | ||
| assert isinstance(filter, SearchFilter) | ||
| match filter: |
2 participants
Unexpected query terms are expected.
Fixes SENTRY-5JJB.