manpro opened a new pull request, #45659: URL: https://github.com/apache/superset/pull/45659
## Summary Fixes #45473 — replaces raw exception text returned to clients with a generic message. Broad `except Exception` handlers in `themes/api.py` returned `str(ex)` directly to clients, and `databases/api.py` passed raw `SQLAlchemyError` text through `error_msg_from_exception()` (which falls back to `str(ex)`). These could expose internal paths, SQL fragments, and stack details to authenticated users. ## Changes - `superset/themes/api.py`: 10 instances of `message=str(ex)` replaced with a generic message - `superset/databases/api.py`: `error_msg_from_exception(ex)` on raw `SQLAlchemyError` replaced with a generic message - Server-side logging (`logger.exception`) already exists in most locations and continues to capture full stack traces ## Rationale CWE-209 (Information Exposure Through an Error Message): returning raw exception text to clients can reveal internal paths, database error details, and system information. This is especially relevant in multi-tenant Superset deployments where low-privileged users could probe for internal details. The fix preserves all server-side logging while returning a safe, generic message to the client. A correlation approach (returning a request ID) could be added later for support workflows. Found via static analysis and reported in #45473. ## Additional Context The majority of the codebase already does the right thing — repo-defined exception classes with static, curated messages (`SupersetException` et al.) returned via `ex.message`, and `ValidationError.messages`. The sites fixed here are the leftovers of that pattern. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
