Fix projections error messages (#382)

FerretDB · Mar 22, 2022 · 7613293 · 7613293
1 parent b0804b4
commit 7613293
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 8 deletions.
diff --git a/internal/handlers/common/error.go b/internal/handlers/common/error.go
@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// Using messages where templates are expected is one of the common sources of security problems.
+// So there are no "constructors" that accept template parameters to avoid pitfalls associated with them.
 package common
 
 import (

diff --git a/internal/handlers/common/projection.go b/internal/handlers/common/projection.go
@@ -15,12 +15,15 @@
 package common
 
 import (
+	"errors"
+	"fmt"
+
 	"github.com/FerretDB/FerretDB/internal/types"
 	"github.com/FerretDB/FerretDB/internal/util/lazyerrors"
 )
 
 // isProjectionInclusion: projection can be only inclusion or exlusion. Validate and return true if inclusion.
-// Exception for the _id field
+// Exception for the _id field.
 func isProjectionInclusion(projection *types.Document) (inclusion bool, err error) {
 	errMsg := "projection must contain only inclusions or exclusions"
 	var exclusion bool
@@ -32,33 +35,33 @@ func isProjectionInclusion(projection *types.Document) (inclusion bool, err erro
 		case bool:
 			if v {
 				if exclusion {
-					err = lazyerrors.New(errMsg)
+					err = errors.New(errMsg)
 					return
 				}
 				inclusion = true
 			} else {
 				if inclusion {
-					err = lazyerrors.New(errMsg)
+					err = errors.New(errMsg)
 					return
 				}
 				exclusion = true
 			}
 		case int32, int64, float64:
 			if compareScalars(v, int32(0)) == equal {
 				if inclusion {
-					err = lazyerrors.New(errMsg)
+					err = errors.New(errMsg)
 					return
 				}
 				exclusion = true
 			} else {
 				if exclusion {
-					err = lazyerrors.New(errMsg)
+					err = errors.New(errMsg)
 					return
 				}
 				inclusion = true
 			}
 		default:
-			err = lazyerrors.Errorf("unsupported operation %s %v (%T)", k, v, v)
+			err = fmt.Errorf("unsupported operation %s %v (%T)", k, v, v)
 			return
 		}
 	}
@@ -73,13 +76,12 @@ func ProjectDocuments(docs []*types.Document, projection *types.Document) error
 
 	inclusion, err := isProjectionInclusion(projection)
 	if err != nil {
-		return err
+		return NewError(ErrBadValue, err)
 	}
 
 	projectionMap := projection.Map()
 	for i := 0; i < len(docs); i++ {
 		for k := range docs[i].Map() {
-
 			v, ok := projectionMap[k]
 			if !ok {
 				if k == "_id" { // if _id is not in projection map, do not do anything with it