Customize Doctrine Exception Message

[jsamouh]

Hello,
I was working on configuration of status code for exception.

For the moment, I define this in config yml file:
exception_to_status:
ApiPlatform\Core\Exception\InvalidArgumentException: 400
Doctrine\DBAL\Exception\UniqueConstraintViolationException: 409

For the first exception, the message return is correct and I do not need to modify it
(Ex: The type of the "my_field" attribute must be "int", "double" given.)

For the second Exception (Doctrine UniqueConstraintViolationException), I have a nice SQL request returned (which is not good for security and in general in production server)

Have you something to catch it or modify the Doctrine message ?
Or is it something it can be developped in API platform ?
At the moment, any Doctrine Exception will return a SQL message:

• NotNullConstraintViolationException
• ForeignKeyConstraintViolationException
• UniqueConstraintViolationException
• SyntaxErrorException
• NonUniqueFieldNameException
• InvalidFieldNameException
• TableNotFoundException
• TableExistsException

Proposed Solution:

In API Platform, the event class responsible to send the data to doctrine (ApiPlatform\Core\Bridge\Doctrine\EventListener\WriteListener), flush the data without catching the Doctrine Exception (line 68)

We need to develop the exception classes above in API Platform and catch the flush operation with theses classes and a better message, am I right ?

Thanks,
Jordan

[dunglas]

You're right. But those exceptions should always be catched by your code and never reach the end user level. Why do you have such exceptions?

You're right about the default message. We should probably do something to not display it in production by default and use generic messages like "Internal Server Error" to not expose sensitive information.

[jsamouh]

@dunglas Thanks for your response.

Bad example. In fact it was a problem with our Entity declaration

Anyway you're right, probably Show generic message for error 500 in production.
I propose a PR for that

[soyuka]

#929

[jsamouh]

@dunglas @soyuka @meyerbaptiste @teohhanhui

In my Team, for an internal reason, we call API POST with a predefined ID.
{
id: 'ea62c86c-d20f-4ce9-a502-441ca96b9434',
name: 'test',
}
In production, when you call 2 times the json above, you have a 409 conflict http error (Client error according Response Object) with a nice DBALException displaying our SQL table ^^
WDYT ? ^^

[teohhanhui]

@jordscream I'm not sure I get what you mean. You're returning a HTTP 409 Conflict, right? So what's with the DBALException? Don't you catch the DBALException and throw your own exception?

[jsamouh]

@teohhanhui , Doctrine returns a 409 conflict cause we try to insert the same ID. But 409 conflict displays in ErrorNormalizer a SQL sensitive details even in production. So for the moment We decorates ErrorNormalizer to catch 409 conflict and hide the SQL details when we are in production. Don't you think this error should be catched in the same way as here ?

Thanks
Jordan

[dunglas]

I'm not sure to understand. If Doctrine fails, it should be a 500 HTTP error.

[dunglas]

Btw you should prevent such errors using the Validator component: http://symfony.com/doc/current/reference/constraints/UniqueEntity.html

[jsamouh]

@dunglas , when doctrine tries to insert with a constraint unique entity, it retourns a 409 conflict.
Anyway, When we use uniqueEntity, it works. Thanks for your advice