773073 - don't send stringified exceptions to the client

Status: RESOLVED FIXED

(Cloud Services Graveyard :: Server: Sync, defect)

Description

[Ryan Kelly [:rfkelly]]

server-syncstorage controller.py currently does this:

        try:
            modified = storage.set_items(user_id, collection_name, kept_bsos)
        except Exception, e:
            # Something went wrong.
            # We want to swallow the 503 in that case.
            self.logger.error('Could not set items')
            self.logger.error(str(e))
            for bso in kept_bsos:
                res['failed'][bso['id']] = str(e)

It is a bad idea to be sending stringified errors back to the client.  We should log it, then send back a generic error message.

Also need to audit the code for other instances of this.

Comment 1

[Ryan Kelly [:rfkelly]]

Attachment: patch to replace stringified error with generic message

Replace the stringified exception with a short generic message.  grep reveals no other locations where stringified exceptions might be leaking through.

Comment 2

[Ryan Kelly [:rfkelly]]

Committed in sync1.1 and sync2.0:

http://hg.mozilla.org/services/server-storage/rev/9d341cf08df5

https://github.com/mozilla-services/server-syncstorage/commit/08482406ef1670b9c8be1bef886b0e5920b8c63a

Comment 3

[James Bonacci [:jbonacci]]

Will verify this against Sync 1.1 and 2.0.