Added masking of errors caused by unexpected exceptions

[xperiandri]

Problem

The raw message of an exception thrown by a field resolver reached HTTP and graphql-transport-ws clients. HTTP responses also carried the raw message of the exception behind a request error, which the WebSocket transport already replaced with a generic one. Such messages can disclose connection strings, SQL or internal paths.

Changes

• Masking (breaking: on by default). An error whose exception is neither a GraphQLException nor an IGQLError, nor an aggregate of only such exceptions, reaches the client as Unexpected error:
  • it keeps its path, its locations and its kind extension;
  • every other extension is dropped.
• Where it applies:
  • HTTP direct, deferred and request error responses;
  • every next and error message of graphql-transport-ws, with the incremental and completed entries of @defer and @stream.
• Turning it off: the new GraphQLOptions.MaskUnexpectedErrors turns masking off for development.
• Logging once per response. The exceptions masked in one response or message are logged once at the error level, with their number, their first paths and the first exception. Each one is also logged at the debug level. One entry per error would let a client multiply log entries with aliases or failing list items.
• IGQLError messages. An error of an IGQLError exception gets the message the exception declares for clients. The default ParseError reports the exception's own message, which could leak.
• WebSocket:
  • a query that does not parse is answered with the parser's message, as over HTTP, instead of Unexpected error during subscription;
  • a GraphQL error thrown while an operation starts keeps its message;
  • the per-operation warnings that repeated every exception with its stack trace are now debug entries.

Tests

The tests are xUnit, in AspNetCore/, over HTTP, the WebSocket connection and the subscription worker:

• masked and kept messages, paths, locations and extensions;
• incremental and completed entries, and request errors;
• masking turned off;
• logging once per message;
• IGQLError messages, syntax errors and errors at operation start.

The behaviour fixes were checked to fail with the previous code.

An independent review ran the real handler and WebSocket connection with failing resolvers, streams and subscription sources. No masked message leaked, and deliberate errors, validation and coercion errors kept their messages.

Verification:

• Unit tests: the whole project passes, 787 tests with 5 skipped.
• FAKE: the full pipeline passes, including the integration tests.

Notes

• No marker on masked errors. graphql-yoga adds extensions.code: INTERNAL_SERVER_ERROR; adding one would let clients tell masked errors apart.
• HTTP exceptions before execution. An exception from a planning middleware or RootFactory still escapes HandleAsync as a 500, as before, while WebSocket masks it.

🤖 Generated with Claude Code

[github-actions]

Test Results

    9 files      9 suites   14m 19s ⏱️
  895 tests   890 ✅  5 💤 0 ❌
2 685 runs  2 670 ✅ 15 💤 0 ❌

Results for commit bcbec91.

♻️ This comment has been updated with latest results.