Value of having some Litestar exception inherit from Python ValueError #4083
Unanswered
mponton-cn
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
I have a Litestar API running at work where it is regularly scanned by some security tool trying to find vulnerabilities. One of the scan tries to use a null byte in the path, which produces a ValueError("embedded null byte") from Starlite. I intercept this via a
exception_logging_handler
so it does not trigger our unhandled exception handler and pollute the logs. However this still ends up with a "500 Internal Error" error which I find ugly, so, to be clever and as a little "f-you" to the security scanner I added anexception_handlers
forValueError
that check for this particular "embedded null byte" error and return a 400 response to the client instead. Because, you know, it's a client "error". If theValueError
I get in the handler was not for this particular issue, I simply assume an unhandled exception and return a 500.I tested the code and it worked. All good.
Until of course some time later while working on something else, having forgotten about that, I spend way too much time trying to figure out while an handler raising
ValidationException
was returning a 500 error. This is where I realized that some Litestar exceptions, includingValidationException
andNotFoundException
inherit fromValueError
. This in turn makes Litestar call my custom exception handler for ValueError for any of these exception.Now, I can see why semantically these are
ValueError
s, but really what is the added value for developers? If this is to group "bad values" exceptions together, why not use a dedicated Litestar class (e.g. "BadValueError")? I feel like mixing native Python exceptions like this into Litestar-specific exception classes can only lead to unexpectedisinstance()
results. Which is what happens in my particular case.Don't get me wrong, the fix is simple and I will simply return to the default 500 error behavior. But still since I lost "some time" figuring this out, I thought I would at least ask what the rationale is behind the design and if, maybe, this is something that could be reviewed for v3.
Cheers to all the great Litestar developers and to the community!
Marco
Beta Was this translation helpful? Give feedback.
All reactions