JsonApiDotNetCore: NotFoundResult throws NullReferenceException
Description
When an id is not found on a GetAsync(id) request, the controller properly returns a NotFoundResult. However, this seems to break after that and what is actually returned to the client is a NullReferenceException.
Most concerning from a security standpoint is that the stack trace is returned.
The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user (hacker). These messages reveal implementation details that should never be revealed.
Reference: Improper Error Handling
I updated my sample repo with a simple integration test (NotFound) that reproduces this behavior. Please advise if I am missing something.
…
Environment
- JsonApiDotNetCore Version: 4.0.0-alpha3
- Other Relevant Package Versions: not sure
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Reactions: 1
- Comments: 16 (10 by maintainers)
Commits related to this issue
- fix: #620 — committed to json-api-dotnet/JsonApiDotNetCore by maurei 5 years ago
- fix: #620 — committed to json-api-dotnet/JsonApiDotNetCore by maurei 5 years ago
- Fix/#620 (#621) * chore: improve testability by exposing SingleData and ManyData on Document * fix: #620 * chore: fix problem in which custom outputter is not executed * chore: enable detail... — committed to json-api-dotnet/JsonApiDotNetCore by maurei 5 years ago
I see where there is a method
DisableDetailedErrorsIfProductionthat is disabling these errors if the “ASPNETCORE_ENVIRONMENT” environment variable equals “Production”, but not everyone’s production environments set that variable to the same value.The method is setting the
DisableErrorStackTracesandDisableErrorSourceproperties on theJsonApiOptionsclass, but when I try to set the same properties on theJsonApiOptionsclass available in theAddJsonApimethod, they aren’t there. Could these options be added to setup for people whose production environments set the “ASPNETCORE_ENVIRONMENT” variable to something besides “Production” (like “prod”, etc.)?