[Security, RFC] Streamline exception handling, prevent disclosure

[dkarlovi]

I'm testing error conditions and default exception handling for my app. Note, all of this is in production environment. This is primarily an RFC so feel free to comment on the behaviour before any action is required.

Things to note:

• Hydra error only for SQL exception, not for DB connection issue
• Exception messages include complete SQL or networking errors

Triggering an SQL exception + Accept: application/ld+json:

• Status 500
• Content-Type: application/ld+json
• @type: error
• hydra:description: <Complete SQL Exception message> (way too verbose)

Triggering an SQL exception + Accept: application/json:

• Status 500
• Content-Type: application/problem+json
• detail: <Complete SQL Exception message> (way too verbose)

DB host down + Accept: application/ld+json:

• Status 500
• Content-Type: application/problem+json
• detail: <Complete SQL Exception message> (way too verbose)

DB host down + Accept: application/json:

• Status 500
• Content-Type: application/problem+json
• detail: <Complete SQL Exception message> (way too verbose)

[dunglas]

Can you review @dkarlovi #978?
Should we mark this issue as a security vulnerability @api-platform/core-team?

[dkarlovi]

@dunglas will try his branch and comment on #978.

IMO you should mark this as a security issue, it's a typical disclosure issue, giving the attacker a lot to work with (ie, identifying the database system and maybe even version, Doctrine, etc), it's a large attack vector.

[Simperfit]

@dkarlovi This has been merged, is it ok fo you ?

[dkarlovi]

@Simperfit I believe this was completed in #1024, yes. Haven't tested it since.