danhuawang opened a new issue, #11434:
URL: https://github.com/apache/gravitino/issues/11434
### What would you like to be improved?
When creating an IDP user with a username exceeding 128 characters, the
server returns HTTP 500 with a `RuntimeException` wrapping a `PSQLException:
ERROR: value too long for type character varying(128)`. The database internal
error and full stack trace are exposed in the API response.
**Current behavior:**
- Request: `POST /api/idp/users` with a 256-character username
- Response: HTTP 500, `code: 1002`, `type: RuntimeException`
- Error message leaks DB schema details: `value too long for type character
varying(128)`
**Expected behavior:**
- Response: HTTP 400, `ILLEGAL_ARGUMENTS_CODE`
- Error message: a user-friendly message like `"Username must not exceed 128
characters"`
This affects both security (DB internals should not be exposed) and user
experience (400 with a clear message is far more actionable than 500 with a
stack trace).
### How should we improve?
Add username length validation at the API/service layer before persisting to
the database:
1. In `IdpUserGroupManager.addUser()` (or the REST layer
`IdpUserOperations.addUser()`), add a precondition check:
```java
if (username == null || username.length() > 128) {
throw new IllegalArgumentException("Username must not exceed 128
characters");
}
```
2. The existing exception handling should map `IllegalArgumentException` to
HTTP 400 with `ILLEGAL_ARGUMENTS_CODE`.
3. Consider applying the same pattern to group names if they share a similar
DB column constraint.
This ensures:
- Users get clear, actionable error messages
- Database schema details are not leaked in API responses
- Validation is consistent regardless of the backend storage engine
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
