markhoerth opened a new issue, #12728:
URL: https://github.com/apache/gravitino/issues/12728
Every error response carries a `stack` array containing internal class
names, line numbers and proxy class names, and it is returned to
unauthenticated callers.
Reproduce:
```
curl -s 'http://<server>:8090/api/metalakes/zz/objects/table/a.b.c/tags'
```
Response includes:
```json
{"code":1008,"type":"ForbiddenException",
"message":"Current user anonymous doesn't exist in the metalake zz, you
should add the user to the metalake first",
"stack":["org.apache.gravitino.exceptions.ForbiddenException: Current user
anonymous doesn't exist in the metalake zz",
"\tat
org.apache.gravitino.authorization.AuthorizationUtils.checkCurrentUser(AuthorizationUtils.java:131)",
"\tat
org.apache.gravitino.server.web.filter.GravitinoInterceptionService$MetadataAuthorizationMethodInterceptor.invoke(GravitinoInterceptionService.java:168)",
"\tat
org.jvnet.hk2.internal.MethodInterceptorHandler.invoke(MethodInterceptorHandler.java:97)",
"\tat
org.apache.gravitino.server.web.rest.MetadataObjectTagOperations_$$_jvst95f_10.listTagsForMetadataObject(...)"]}
```
The `code`, `type` and `message` fields already give a client everything it
needs to handle the error. The stack exposes internal class structure, line
numbers and the hk2 and javassist proxy chain to any caller, including an
unauthenticated one, and it is what the Enterprise UI currently renders in an
error toast.
Required: the stack is omitted from error responses by default, and is
included only when an explicit server setting enables it.
Observed on every error path in a sweep of all 130 `/metalakes` endpoints,
build 1.3.0-SNAPSHOT, commit 6d9d432df18a9bd124c162ea50a296f436549980.
Required: fixed upstream in apache/gravitino and present in the enterprise
tree before RC2 on September 4.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
