Skip to content
Sarj Code Standards

no-exception-text-in-500-detail

HTTP 500 exception details must not carry exception text or tracebacks.

SARJ505 Rule source Tests Catalog JSON

Why

An unexpected exception's text can contain SQL, file paths, hostnames, provider responses or personal data. Copying it into a 500 response discloses internals to any caller and gives attackers a probe.

Fix

Log the exception with its traceback, then raise the 500 with a fixed detail or error code.

Examples

Before — flagged A 500 detail returns the exception message
api.py
from fastapi import HTTPException




def load(store) -> None:
    try:
        store.load()
    except Exception as exc:
        raise HTTPException(status_code=500, detail=f"load failed: {exc}") from exc
After — preferred A 500 detail is a fixed message
api.py
from fastapi import HTTPException




def load(store) -> None:
    try:
        store.load()
    except Exception as exc:
        raise HTTPException(status_code=500, detail="load failed") from exc