Fix/security vulnerability

datahub/dnb_api/test/test_views.py

@@ -604,18 +604,18 @@ def test_post_invalid(
             (
                 [],
                 400,
-                'Cannot find a company with duns_number: 123456789',
+                'The request could not be completed due to an issue with the provided data.',
             ),
             (
                 ['foo', 'bar'],
                 502,
-                'Multiple companies found with duns_number: 123456789',
+                'An error occurred while processing your request. Please try again later.',
             ),
             (
                 [{'duns_number': '012345678'}],
                 502,
-                'DUNS number of the company: 012345678 '
-                'did not match searched DUNS number: 123456789',
+                'An error occurred while processing your request. '
+                'Please try again later.',
             ),
         ),
     )
@@ -1042,7 +1042,8 @@ def test_already_linked(self):
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
         assert response.json() == {
-            'detail': f'Company {str(company.id)} is already linked ' 'with duns number 123456789',
+            'detail':
+            'The request could not be completed due to a problem with the provided data.',
         }
 
     def test_duplicate_duns_number(self):
@@ -1087,7 +1088,8 @@ def test_company_not_found(
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
         assert response.json() == {
-            'detail': 'Cannot find a company with duns_number: 123456789',
+            'detail':
+            'The request could not be completed due to a problem with the provided data.',
         }
 
     def test_valid(

datahub/dnb_api/utils.py

@@ -1011,8 +1011,11 @@
         DNBServiceConnectionError,
         DNBServiceTimeoutError,
         DNBServiceError,
-    ) as exc:
-        raise APIUpstreamException(str(exc))
+    ):
+        logger.error(
+            'An error occurred while retrieving company hierarchy data.')
+        raise APIUpstreamException(
+            'An error occurred while retrieving company data. Please try again later.')
     family_tree_members = response.data
     if not family_tree_members:
         return json_response

datahub/dnb_api/views.py

@@ -90,8 +90,10 @@
         except (
             DNBServiceConnectionError,
             DNBServiceTimeoutError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
+        ):
+            logger.error('Error communicating with DNB service during company search.')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
         except DNBServiceError as exc:
             return HttpResponse(
                 exc.message,
@@ -198,11 +200,16 @@
             DNBServiceConnectionError,
             DNBServiceError,
             DNBServiceInvalidResponseError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
-
-        except DNBServiceInvalidRequestError as exc:
-            raise APIBadRequestException(str(exc))
+        ):
+            logger.error(
+                'An error occurred while retrieving data for DUNS number')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
+        except DNBServiceInvalidRequestError:
+            logger.warning(
+                'Invalid request for DUNS number')
+            raise APIBadRequestException(
+                'The request could not be completed due to an issue with the provided data.')
 
         company_serializer = DNBCompanySerializer(
             data=dnb_company,
@@ -265,14 +272,21 @@
             DNBServiceConnectionError,
             DNBServiceInvalidResponseError,
             DNBServiceError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
+        ):
+            logger.error(
+                'An error occurred while linking company ID with DUNS number',
+            )
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
 
         except (
             DNBServiceInvalidRequestError,
             CompanyAlreadyDNBLinkedError,
-        ) as exc:
-            raise APIBadRequestException(str(exc))
+        ):
+            logger.warning(
+                'Invalid request or company ID is already linked to DUNS number')
+            raise APIBadRequestException(
+                'The request could not be completed due to a problem with the provided data.')
 
         return Response(
             CompanySerializer().to_representation(company),
@@ -306,8 +320,10 @@
             DNBServiceConnectionError,
             DNBServiceTimeoutError,
             DNBServiceError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
+        ):
+            logger.error('An error occurred while processing DNB companies POST request.')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
 
         return Response(response)
 
@@ -331,9 +347,11 @@
             DNBServiceConnectionError,
             DNBServiceTimeoutError,
             DNBServiceError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
-
+        ):
+            logger.error(
+                'An error occurred while processing GET request for DUNS number')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
         return Response(response)
 
 
@@ -367,9 +385,10 @@
             DNBServiceConnectionError,
             DNBServiceTimeoutError,
             DNBServiceError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
-
+        ):
+            logger.error('An error occurred while creating an investigation for the company.')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
         company.dnb_investigation_id = response['id']
         company.pending_dnb_investigation = True
         company.save()
@@ -400,8 +419,11 @@
             DNBServiceError,
             DNBServiceInvalidRequestError,
             DNBServiceInvalidResponseError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
+        ):
+            logger.error(
+                'Failed to retrieve company hierarchy count for DUNS number from dnb-service')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
 
         manually_verified = self.get_manually_verified_subsidiaries(
             company_id,
@@ -524,8 +546,11 @@
             DNBServiceConnectionError,
             DNBServiceTimeoutError,
             DNBServiceError,
-        ) as exc:
-            raise APIUpstreamException(str(exc))
+        ):
+            logger.error(
+                'Failed to retrieve company hierarchy count for DUNS number')
+            raise APIUpstreamException(
+                'An error occurred while processing your request. Please try again later.')
 
         json_response = {
             'related_companies_count': companies_count,

datahub/omis/payment/govukpay.py

@@ -47,8 +47,12 @@ def _raise_for_status(self, response):
         """
         try:
             response.raise_for_status()
-        except requests.HTTPError as exc:
-            raise GOVUKPayAPIException(exc) from exc
+        except requests.HTTPError:
+
+            logger.error(f'HTTPError occurred with status code: {response.status_code}')
+            # Raise a generic exception for the user with less information
+            raise GOVUKPayAPIException(
+                'An error occurred while processing your request. Please try again later.')
 
     def _request(self, method, path, **kwargs):
         """

datahub/omis/payment/test/test_govukpay.py

@@ -77,7 +77,9 @@ def test_http_error(self, status_code, error_msg, requests_mock):
                 description='payment description',
                 return_url='http://return.example.com',
             )
-        assert exc.value.detail == f'{error_msg}: {error_msg} for url: {url}'
+        # Check that the exception contains the generic message
+        assert exc.value.detail == (
+            'An error occurred while processing your request. Please try again later.')
 
 
 class TestPayClientGetPaymentById:
@@ -126,7 +128,9 @@ def test_http_error(self, status_code, error_msg, requests_mock):
         with pytest.raises(GOVUKPayAPIException) as exc:
             pay = PayClient()
             pay.get_payment_by_id(payment_id)
-        assert exc.value.detail == f'{error_msg}: {error_msg} for url: {url}'
+        # Check that the exception contains the generic message
+        assert exc.value.detail == (
+            'An error occurred while processing your request. Please try again later.')
 
 
 class TestPayClientCancelPayment:
@@ -158,12 +162,14 @@ def test_ok(self, requests_mock):
         ),
     )
     def test_http_error(self, status_code, error_msg, requests_mock):
-        """Test that if GOV.UK Pay returns an HTTP error, an exception is raised."""
+        """Test that if GOV.UK Pay returns an HTTP error, a generic exception is raised."""
         payment_id = '123abc123abc123abc123abc12'
         url = govuk_url(f'payments/{payment_id}/cancel')
         requests_mock.post(url, status_code=status_code, reason=error_msg)
 
         with pytest.raises(GOVUKPayAPIException) as exc:
             pay = PayClient()
             pay.cancel_payment(payment_id)
-        assert exc.value.detail == f'{error_msg}: {error_msg} for url: {url}'
+        # Check that the exception contains the generic message
+        assert exc.value.detail == (
+            'An error occurred while processing your request. Please try again later.')