fix: remove error from dyn field failure response to prevent exposure#220
fix: remove error from dyn field failure response to prevent exposure#220
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This + the previous PR are okay but I realized we are breaking an important UX in our dynamic form. Users will now get some vague "Failed to create field" instead of per-field hints. I will refactor this a bit more to provide a middle ground (Good ux + no codeql info exposure) |
Expose validation errors (4xx) to users for actionable feedback while logging server errors (5xx) to prevent information leakage. Added expose_errors parameter for manual override when needed. Updated dynamic fields endpoint to pass errors via errors parameter instead of interpolating into message.
|
Updated now with a smart fix : 4xx validation errors dont expose sensitive info and will be sent to the user. 5xx error are hidden from users. Http Response class handles them automatically. |
level09
left a comment
There was a problem hiding this comment.
I think this is good to go, balances security with UX.
Test I ran: overly long field titles in dynamic forms. Database errors properly masked while validation errors remained visible.
But this revealed unrelated minor validation bug during testing (missing max length check), will fix separately in another PR.
@apodacaduron I think we need this on FE as well, I'll provide details 👍
Jira Issue
Description
[Brief description of changes]
Checklist
API Changes (if applicable)
Additional Notes
[Any other relevant information]