Sanitize 400 error messages in GlobalExceptionHandler and validation filters to use static strings. This change improves consistency and prevents leaking internal exception details. Updated tests to reflect new error messages for JSON parsing and bad request scenarios.
ci/woodpecker/push/01-test Pipeline failed
ci/woodpecker/push/02-build-push unknown status

This commit is contained in:
Oleksandr Bezdieniezhnykh
2026-06-25 19:02:25 +03:00
parent 7ed780b063
commit 01d7e7d584
12 changed files with 209 additions and 38 deletions
@@ -108,7 +108,36 @@ public class GlobalExceptionHandlerTests
root.GetProperty("errors")
.GetProperty("tiles[0].foo")[0]
.GetString()
.Should().Contain("could not be mapped");
.Should().Be("The field value is invalid.");
root.GetProperty("errors")
.GetProperty("tiles[0].foo")[0]
.GetString()
.Should().NotContain("TileInventoryRequest");
}
[Fact]
public async Task TryHandleAsync_BadHttpRequestExceptionWithoutJson_UsesStaticDetail()
{
// Arrange
var loggerMock = new Mock<ILogger<GlobalExceptionHandler>>();
var handler = new GlobalExceptionHandler(loggerMock.Object);
var httpContext = new DefaultHttpContext { TraceIdentifier = "trace-bind-static" };
httpContext.Response.Body = new MemoryStream();
var bindFailure = new BadHttpRequestException(
"Failed to bind parameter \"double Latitude\" from \"abc\".",
StatusCodes.Status400BadRequest);
// Act
var handled = await handler.TryHandleAsync(httpContext, bindFailure, CancellationToken.None);
// Assert
handled.Should().BeTrue();
httpContext.Response.Body.Position = 0;
using var doc = JsonDocument.Parse(httpContext.Response.Body);
doc.RootElement.GetProperty("detail").GetString()
.Should().Be("The request could not be processed.");
doc.RootElement.GetProperty("detail").GetString()
.Should().NotContain("Latitude");
}
[Fact]
@@ -173,7 +173,7 @@ public class UavTileUploadHandlerTests : IDisposable
// Assert
result.EnvelopeRejected.Should().BeTrue();
result.EnvelopeError.Should().Contain("Invalid `metadata` JSON");
result.EnvelopeError.Should().Be("`metadata` could not be parsed as JSON.");
}
[Fact]