bito-code-review[bot] commented on PR #43473:
URL: https://github.com/apache/superset/pull/43473#issuecomment-5398826665
<!-- Bito Reply -->
The security concern regarding the exposure of backend-specific database
details in `SupersetException` messages is valid. To resolve this, you should
sanitize the exception message before it is passed to the `SupersetException`
constructor, ensuring that only generic, safe information is returned to the
client while logging the detailed cause server-side.
In `superset/utils/decorators.py`, you can modify the `on_error` function to
handle the exception message more securely:
```python
# Example of sanitizing the exception message
if preserve_message:
# Log the full exception for debugging
logger.exception("Task operation failed: %s", str(source))
# Return a sanitized message to the client
message = "An internal error occurred while processing the task."
# ... proceed with raising the exception using the sanitized message
```
Would you like me to fetch all other comments on this PR to validate them
and implement a minimal fix for the rest as well?
**superset/utils/decorators.py**
```
# Example of sanitizing the exception message
if preserve_message:
# Log the full exception for debugging
logger.exception("Task operation failed: %s", str(source))
# Return a sanitized message to the client
message = "An internal error occurred while processing the task."
# ... proceed with raising the exception using the sanitized message
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
