Merge pull request #68 from redBorder/fix_code_scanning_alert

PR-57: Fix code scanning alert - Information exposure through an exception

resources/src/server/rest.py

@@ -101,9 +101,7 @@ def calculate(self):
         data = request.form.get('data')
         druid_query = request.form.get('query')
         if data is None and druid_query is None:
-            error_message="No data provided or requested"
-            logger.logger.error(error_message)
-            return self.return_error(error=error_message)
+            return self.return_error(msg="No data provided or requested")
         try:
             if data is None:
                 druid_query=self.decode_b64_json(druid_query)
@@ -112,7 +110,7 @@ def calculate(self):
             else:
                 data = self.decode_b64_json(data)
         except Exception as e:
-            return self.return_error(error=str(e))
+            return self.return_error(msg="Could not execute druid query", exception=e)
         logger.logger.info("Starting outliers execution")
         return self.execute_model(data, config.get("Outliers","metric"), model)
 
@@ -217,18 +215,22 @@ def execute_model(self, data, metric, model='default'):
                 metric,
             ))
         except Exception as e:
-            error_message = "Error while calculating prediction model"
-            logger.logger.error(error_message + ": " + str(e))
-            return self.return_error(error=error_message)
+            return self.return_error(msg="Error while calculating prediction model", exception=e)
 
-    def return_error(self, error="error"):
+    def return_error(self, msg="error", exception=None):
         """
-        Returns an adequate formatted JSON for whenever there is an error.
+        Returns a properly formatted JSON response for errors.
 
         Args:
-            error (string): message detailing what type of error has been fired.
+            msg (str): Message detailing the type of error that has occurred.
+            exception (Exception, optional): Exception object to include in the error message. Defaults to None.
+
+        Returns:
+            Response: JSON response indicating an error status.
         """
-        return jsonify({ "status": "error", "msg":error })
+        logged_error = msg + f": {exception}" if exception else msg
+        logger.logger.error(logged_error)
+        return jsonify({ "status": "error", "msg":msg })
 
     def start_s3_sync_thread(self):
         """

resources/tests/test_rest.py

@@ -54,7 +54,7 @@ def test_calculate_endpoint_invalid_query(self):
             self.assertEqual(response.status_code, 200)
             self.assertEqual(
                 response.get_json(),
-                {'msg': 'Error decoding json', 'status': 'error'}
+                {'msg': 'Could not execute druid query', 'status': 'error'}
             )
 
     def test_calculate_endpoint_druid_query_execution_malfunction(self):