如何停止在 Azure 移动应用的 OData 错误中泄露实施细节？

Question

我正在使用 Azure 移动应用服务。

假设我有一个Customer 实体，带有一个Orders 导航属性。然后我可以这样做：

http://foo.url.com/tables/Customer?$expand=Orders

但假设我尝试扩展非导航属性Foo：

http://foo.url.com/tables/Customer?$expand=Foo

然后我会在客户端（或邮递员）上得到这个：

{
"message": "The query specified in the URI is not valid. Property 'Foo' on type 'my.namespace.Customer' is not a navigation property. Only navigation properties can be expanded.",
"exceptionMessage": "Property 'Foo' on type 'my.namespace.Customer' is not a navigation property. Only navigation properties can be expanded.",
"exceptionType": "Microsoft.Data.OData.ODataException",
"stackTrace": "   at Microsoft.Data.OData.Query.SyntacticAst.ExpandBinder... VERY LONG STACKTRACE..."
}

或者假设我尝试扩展不存在的属性Bar：

http://foo.url.com/tables/Customer?$expand=Bar

然后我会在客户端（或邮递员）上得到这个：

{
"message": "The query specified in the URI is not valid. Could not find a property named 'Bar' on type 'my.namespace.Customer'.",
"exceptionMessage": "Could not find a property named 'Bar' on type 'my.namespace.Customer'.",
"exceptionType": "Microsoft.Data.OData.ODataException",
"stackTrace": "   at Microsoft.Data.OData.Query.SyntacticAst.ExpandBinder... VERY LONG STACKTRACE"
}

如果我编辑配置以包含config.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Never，那么它仍然会在此错误中泄漏命名空间（它还鼓励攻击者执行枚举攻击并尝试各种排列）：

{
"message": "The query specified in the URI is not valid. Property 'Foo' on type 'my.namespace.Customer' is not a navigation property. Only navigation properties can be expanded."
}

和

{
"message": "The query specified in the URI is not valid. Could not find a property named 'Bar' on type 'my.namespace.Customer'."
}

这会泄露许多攻击者感兴趣的实现细节。如何抑制/替换该错误消息？

Answer 1

（使用新信息更新答案）

事实证明，Web API 本身会发生这种情况，而标准的 ExceptionFilter 和 ExceptionHandler 机制似乎不起作用。

如果您收到 400，似乎对重写响应有效的一件事如下：

public class MyExceptionFilterAttribute : ActionFilterAttribute
{
    public override void OnActionExecuted(HttpActionExecutedContext actionExecutedContext)
    {
        if (actionExecutedContext.Response.StatusCode == System.Net.HttpStatusCode.BadRequest)
        {
            actionExecutedContext.Response.Content = new StringContent("An error occurred.");
        }
    }
}

可能有比这更好的方法。