cannot suppress wsgi error tracebacks in 500 using pesto

[Samuel Wan]

I am having trouble suppressing tracebacks in 500 errors using the
pesto framework. When I try to log errors through the wsgilog module,
it only works for a regular wsgi application, but the dispatcher
somehow keeps sending the whole traceback in the HTTP response, which
I want to prevent for security and other reasons. Here's a test case
that uses cherrypy, pesto, and wsgilog:

import cherrypy
import wsgilog
import logging
from pesto import Response, dispatcher_app
from pesto.request import Request

dispatcher = dispatcher_app()
@dispatcher.match('/', 'GET')
def pesto_app(request):
raise Exception("This is an error message")
return Response(content=['Hello world'])

def wsgi_app(environ, start_response):
raise Exception("This is an error message")
start_response('200 OK', [('Content-type','text/plain')])
return ['Hello world']

if __name__ == '__main__':
global_conf = {
'server.socket_host': "0.0.0.0",
'server.socket_port': 8888,
'engine.autoreload_on': True,
}
cherrypy.config.update(global_conf)
logged_app = wsgilog.WsgiLog(dispatcher, tohtml=False, tostream=True,
tofile=False)
cherrypy.tree.graft(logged_app, '')
cherrypy.quickstart()


When I pass the pesto dispatcher to the WsgiLog constructor, and then
visit "http://localhost", the http response includes the whole
traceback statement:

Traceback (most recent call last):
File "/Library/Python/2.5/site-packages/CherryPy-3.1.2-py2.5.egg/
cherrypy/wsgiserver/__init__.py", line 1174, in communicate
req.respond()
File "/Library/Python/2.5/site-packages/CherryPy-3.1.2-py2.5.egg/
cherrypy/wsgiserver/__init__.py", line 544, in respond
self._respond()
File "/Library/Python/2.5/site-packages/CherryPy-3.1.2-py2.5.egg/
cherrypy/wsgiserver/__init__.py", line 558, in _respond
for chunk in response:
File "/Users/samwan/Documents/projects/qrproto/sandbox/lib/python2.5/
site-packages/pesto-21-py2.5.egg/pesto/core.py", line 103, in next
response = self.decorated_app.pesto_app(*args,
**self.decorated_app.app_kwargs)
File "servertest.py", line 10, in pesto_app
raise Exception("This is an error message")
Exception: This is an error message

However, when I pass the regular wsgi_app to the WsgiLog constructor,
then visit "http://localhost", the traceback is successfully
suppressed in the HTTP response. Am I missing something about how
Pesto handles error logging? Is there a pesto configuration that I've
missed?

[Oliver Cope]

On 20/12/2010 02:18, Samuel Wan wrote:
> I am having trouble suppressing tracebacks in 500 errors using the
> pesto framework. When I try to log errors through the wsgilog module,
> it only works for a regular wsgi application, but the dispatcher
> somehow keeps sending the whole traceback in the HTTP response, which
> I want to prevent for security and other reasons.

Hi Samuel,

Pesto doesn't try to do anything related to catching or logging
application errors, so these tracebacks must be being generated upstream
by cherrypy.

Running your test code under wsgiref doesn't show the problem, which
confirms that these tracebacks must be coming from cherrypy. I had a
quick look at the cherrypy docs for error handling but I couldn't
quickly see what you need to configure to turn off these tracebacks.

It's unfortunate that wsgilog doesn't seem to be catching these errors
as it should. I had a look at the wsgilog source code and I think it is
failing to catch exceptions raised while iterating the response. Because
of the way that pesto interfaces with wsgi pretty much all exceptions
will be raised at this stage. It might be worth talking to the author of
wsgilog about this as I'm sure it will affect other wsgi applications too.

Olly.

[Samuel Wan]

Olly,

Thanks for taking the time to look into this even into the cherrypy
docs and wsgilog source. It's much appreciated, since you've saved me
a lot of time knowing now that it's not a pesto issue. I'll
investigate further and will post my findings.

-Sam

> --
> You received this message because you are subscribed to the Google Groups
> "Pesto" group.
> To post to this group, send email to python...@googlegroups.com.
> To unsubscribe from this group, send email to
> python-pesto...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/python-pesto?hl=en.
>
>