CVE-2023-26051 (Python, published 2023-03-02T19:15Z)
Description: value: Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/saleor/saleor
Files changed:
saleor/graphql/account/tests/test_account.py
saleor/graphql/core/mutations.py
saleor/graphql/core/tests/test_view.py
saleor/graphql/tests/test_utils.py
saleor/graphql/utils/__init__.py
Commit message: Merge pull request from GHSA-r8qr-wwg3-2r85

* Block internal exception messages in API

* Fix isort

* Add more exceptions to allowed ones

* Adjust test

Vulnerable code:
    results = response.json()
    assert "errors" in results
    assert (
        results["errors"][0]["message"]
        == "Invalid token. User does not exist or is inactive."
    )
        setup_context_user(info.context)
        setup_context_user(info.context)
    assert content["errors"][0]["message"] == "Spanish inquisition"

Fixed code:
                code
    content = get_graphql_content(response)
    data = content["data"]["requestPasswordReset"]
    assert len(data["errors"]) == 1
    assert data["errors"][0]["code"] == AccountErrorCode.JWT_INVALID_TOKEN.name
import jwt
from ...account.error_codes import AccountErrorCode
        try:
            setup_context_user(info.context)
        except jwt.InvalidTokenError:
            return cls.handle_errors(
                ValidationError(
                    "Invalid token", code=AccountErrorCode.JWT_INVALID_TOKEN.value
                )
            )
        try:
            setup_context_user(info.context)
        except jwt.InvalidTokenError:
            return cls.handle_errors(
                ValidationError(
                    "Invalid token", code=AccountErrorCode.JWT_INVALID_TOKEN.value
                )
            )
from ....graphql.utils import INTERNAL_ERROR_MESSAGE
    assert content["errors"][0]["message"] == INTERNAL_ERROR_MESSAGE
from django.test import override_settings
from ..utils import ALLOWED_ERRORS, INTERNAL_ERROR_MESSAGE, format_error


@override_settings(DEBUG=False)
def test_format_error_hides_internal_error_msg_in_production_mode():
    error = ValueError("Example error")
    result = format_error(error, ())
    assert result["message"] == INTERNAL_ERROR_MESSAGE


@override_settings(DEBUG=False)
def test_format_error_prints_allowed_errors():
    error_cls = ALLOWED_ERRORS[0]
    error = error_cls("Example error")
    result = format_error(error, ())
    assert result["message"] == str(error)


@override_settings(DEBUG=True)
def test_format_error_prints_internal_error_msg_in_debug_mode():
    error = ValueError("Example error")
    result = format_error(error, ())
    assert result["message"] == str(error)
from django.core.exceptions import ValidationError
from ...core.exceptions import (
    CircularSubscriptionSyncEvent,
    PermissionDenied,
    ReadOnlyException,
)
from ..core.validators.query_cost import QueryCostError
# List of error types of which messages can be returned in the GraphQL API.
ALLOWED_ERRORS = [
    CircularSubscriptionSyncEvent,
    GraphQLError,
    PermissionDenied,
    ReadOnlyException,
    ValidationError,
    QueryCostError,
]

INTERNAL_ERROR_MESSAGE = "Internal Server Error"

    # If DEBUG mode is disabled we allow only certain error messages to be returned in
    # the API. This prevents from leaking internals that might be included in Python
    # exceptions' error messages.
    if type(exc) not in ALLOWED_ERRORS and not settings.DEBUG:
        result["message"] = INTERNAL_ERROR_MESSAGE