Language: Python
Label: vulnerable
CWE: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.

Code:
def test_account_reset_password_user_is_inactive(
    mocked_notify, user_api_client, customer_user, channel_USD
):
    user = customer_user
    user.is_active = False
    user.save()

    variables = {
        "email": customer_user.email,
        "redirectUrl": "https://www.example.com",
        "channel": channel_USD.slug,
    }
    response = user_api_client.post_graphql(REQUEST_PASSWORD_RESET_MUTATION, variables)
    results = response.json()
    assert "errors" in results
    assert (
        results["errors"][0]["message"]
        == "Invalid token. User does not exist or is inactive."
    )
    assert not mocked_notify.called