Visitar URL original
fix(knex): omit queries from all database error messages by marshallswain · Pull Request #3725 · feathersjs/feathers · GitHub
Skip to content

fix(knex): omit queries from all database error messages - #3725

Merged
marshallswain merged 4 commits into
dovefrom
knex-error-query
Oct 27, 2026
Merged

marshallswain merged 4 commits into
dovefrom
knex-error-query

Conversation

@marshallswain

@marshallswain marshallswain commented Oct 26, 2026 •

Copy link
Copy Markdown
Member

Closes #3711. Supersedes #3712 and keeps @SteveSande's commit, which fixed the Postgres branch.

Knex adds the query, with its bound values filled in by default, to the front of every driver error as <sql> - <message>. errorHandler read error.message before the Postgres branch removed the query, so the full query went to the client. The MySQL (sqlState), SQLite and fallback branches never removed it at all. For example, a duplicate-email create on SQLite returned:

insert into `users` (`email`, `password`) values ('a@example.com', 'secret-hash-2') returning `id` - SQLITE_CONSTRAINT: UNIQUE constraint failed: users.email

The fix removes the query once, at the top of errorHandler, keeping only the text after the last -, and every branch uses that message. The raw driver error is unchanged on error[ERROR] for server-side logging. Errors that are already Feathers errors pass through as before.

Tests: unit tests for the sqlState, SQLite and fallback branches, and an in-memory SQLite test through KnexService. The new tests fail before the fix. The @feathersjs/knex suite passes.

Follow-up from review:

  • patch and the paginated count query now go through errorHandler. Before this, a unique-constraint error on patch returned the full update with the bound values.
  • MySQL errors use the driver's original sqlMessage, and SQLite errors cut at - <code>:, so values that contain - no longer garble the message.
  • Knex compile errors (Undefined binding(s) detected ... query: <sql>) drop the query.
  • Errors without a message keep the default Error message, and errorHandler is typed never.
  • Only errors from database drivers (those with code, errno, number or sqlState) are cut, so other errors keep their full message. An empty MySQL sqlMessage falls back to the general rule.

ssande-fwd and others added 4 commits October 25, 2026 23:09
The PostgreSQL branch of the error handler stripped the SQL from the raw driver error message but the constructed errors used the raw message, so the SQL still went through. Improved the SQL parsing and actually used it for the error construction.

Fixes #3711
@marshallswain
marshallswain merged commit f300461 into dove Oct 27, 2026
4 of 8 checks passed
@marshallswain
marshallswain deleted the knex-error-query branch October 27, 2026 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Postgres query leaked in error

2 participants