Hide & Log Subscription portal API error messages

ee/changelogs/unreleased/230399-db-query-disclosure-through-error-message-in-start-a-free-gold-.yml

+---
+title: Unsurface Subscription portal API error messages
+merge_request: 59487
+author:
+type: changed

ee/lib/gitlab/subscription_portal/clients/rest.rb

@@ -7,6 +7,8 @@ module Gitlab
         extend ActiveSupport::Concern
 
         class_methods do
+          SubscriptionPortalRESTException = Class.new(RuntimeError)
+
           def generate_trial(params)
             http_post("trials", admin_headers, params)
           end
@@ -33,6 +35,25 @@ module Gitlab
 
           private
 
+          def error_message
+            _('We encountered an error and our team has been notified. Please try again.')
+          end
+
+          def reparse_response(response)
+            result = parse_response(response)
+
+            if !result[:success] && result[:data]
+              track_exception(result[:data][:errors])
+              result[:data][:errors] = error_message
+            end
+
+            result
+          end
+
+          def track_exception(message)
+            Gitlab::ErrorTracking.track_exception(SubscriptionPortalRESTException.new(message))
+          end
+
           def base_url
             EE::SUBSCRIPTIONS_URL
           end
@@ -40,25 +61,28 @@ module Gitlab
           def http_get(path, headers)
             response = Gitlab::HTTP.get("#{base_url}/#{path}", headers: headers)
 
-            parse_response(response)
+            reparse_response(response)
           rescue *Gitlab::HTTP::HTTP_ERRORS => e
-            { success: false, data: { errors: e.message } }
+            track_exception(e.message)
+            { success: false, data: { errors: error_message } }
           end
 
           def http_post(path, headers, params = {})
             response = Gitlab::HTTP.post("#{base_url}/#{path}", body: params.to_json, headers: headers)
 
-            parse_response(response)
+            reparse_response(response)
           rescue *Gitlab::HTTP::HTTP_ERRORS => e
-            { success: false, data: { errors: e.message } }
+            track_exception(e.message)
+            { success: false, data: { errors: error_message } }
           end
 
           def http_put(path, headers, params = {})
             response = Gitlab::HTTP.put("#{base_url}/#{path}", body: params.to_json, headers: headers)
 
-            parse_response(response)
+            reparse_response(response)
           rescue *Gitlab::HTTP::HTTP_ERRORS => e
-            { success: false, data: { errors: e.message } }
+            track_exception(e.message)
+            { success: false, data: { errors: error_message } }
           end
         end
       end

ee/spec/lib/gitlab/subscription_portal/clients/rest_spec.rb

@@ -6,6 +6,7 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
   let(:client) { Gitlab::SubscriptionPortal::Client }
   let(:http_response) { nil }
   let(:http_method) { :post }
+  let(:error_message) { 'We encountered an error and our team has been notified. Please try again.' }
   let(:gitlab_http_response) do
     double(code: http_response.code, response: http_response, body: {}, parsed_response: {})
   end
@@ -20,13 +21,29 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     end
   end
 
+  shared_examples 'when http call raises an exception' do
+    it 'overrides the error message' do
+      exception = Gitlab::HTTP::HTTP_ERRORS.first.new
+      tracked_exception = Gitlab::SubscriptionPortal::Clients::REST::SubscriptionPortalRESTException.new(exception.message)
+      allow(Gitlab::HTTP).to receive(http_method).and_raise(exception)
+      expect(Gitlab::ErrorTracking).to receive(:track_exception).with(tracked_exception)
+
+      result = subject
+
+      expect(result[:success]).to eq(false)
+      expect(result[:data][:errors]).to eq(error_message)
+    end
+  end
+
   shared_examples 'when response code is 422' do
     let(:http_response) { Net::HTTPUnprocessableEntity.new(1.0, '422', 'Error') }
 
     it 'has a unprocessable entity status' do
       allow(Gitlab::HTTP).to receive(http_method).and_return(gitlab_http_response)
+      expect(Gitlab::ErrorTracking).to receive(:track_exception)
 
       expect(subject[:success]).to eq(false)
+      expect(subject[:data][:errors]).to eq(error_message)
     end
   end
 
@@ -35,8 +52,10 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
 
     it 'has a server error status' do
       allow(Gitlab::HTTP).to receive(http_method).and_return(gitlab_http_response)
+      expect(Gitlab::ErrorTracking).to receive(:track_exception)
 
       expect(subject[:success]).to eq(false)
+      expect(subject[:data][:errors]).to eq(error_message)
     end
   end
 
@@ -48,6 +67,7 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     it_behaves_like 'when response is successful'
     it_behaves_like 'when response code is 422'
     it_behaves_like 'when response code is 500'
+    it_behaves_like 'when http call raises an exception'
   end
 
   describe '#extend_reactivate_trial' do
@@ -60,6 +80,7 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     it_behaves_like 'when response is successful'
     it_behaves_like 'when response code is 422'
     it_behaves_like 'when response code is 500'
+    it_behaves_like 'when http call raises an exception'
   end
 
   describe '#create_subscription' do
@@ -70,6 +91,7 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     it_behaves_like 'when response is successful'
     it_behaves_like 'when response code is 422'
     it_behaves_like 'when response code is 500'
+    it_behaves_like 'when http call raises an exception'
   end
 
   describe '#create_customer' do
@@ -80,6 +102,7 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     it_behaves_like 'when response is successful'
     it_behaves_like 'when response code is 422'
     it_behaves_like 'when response code is 500'
+    it_behaves_like 'when http call raises an exception'
   end
 
   describe '#payment_form_params' do
@@ -92,6 +115,7 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     it_behaves_like 'when response is successful'
     it_behaves_like 'when response code is 422'
     it_behaves_like 'when response code is 500'
+    it_behaves_like 'when http call raises an exception'
   end
 
   describe '#payment_method' do
@@ -104,5 +128,6 @@ RSpec.describe Gitlab::SubscriptionPortal::Clients::REST do
     it_behaves_like 'when response is successful'
     it_behaves_like 'when response code is 422'
     it_behaves_like 'when response code is 500'
+    it_behaves_like 'when http call raises an exception'
   end
 end

locale/gitlab.pot

@@ -35709,6 +35709,9 @@ msgstr ""
 msgid "We don't have enough data to show this stage."
 msgstr ""
 
+msgid "We encountered an error and our team has been notified. Please try again."
+msgstr ""
+
 msgid "We have found the following errors:"
 msgstr ""