Merge pull request #29998 from abinavsridhar-wk/fix-search-issue-29961

.changeset/wicked-socks-share.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend': patch
+---
+
+Error messages should not contain backend SQL query strings in the API response, this change will ensure that messages are logged and empty response is returned to the user

plugins/search-backend/src/service/router.test.ts

@@ -106,7 +106,7 @@ describe('createRouter', () => {
         expect.objectContaining({
           error: {
             name: 'Error',
-            message: `There was a problem performing the search query: ${error.message}`,
+            message: `There was a problem performing the search query`,
           },
         }),
       );

plugins/search-backend/src/service/router.ts

@@ -197,14 +197,17 @@ export async function createRouter(
 
       res.json(filterResultSet(toSearchResults(resultSet)));
     } catch (error) {
+      // Log the error message here, but don't expose it to the user in the response
+      logger.error(
+        `There was a problem performing the search query: ${error.message}`,
+      );
       if (error.name === 'MissingIndexError') {
         // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form
         throw error;
       }
 
-      throw new Error(
-        `There was a problem performing the search query: ${error.message}`,
-      );
+      // If the error is not a MissingIndexError, we want to throw a generic error without the error message as it may leak internal information
+      throw new Error(`There was a problem performing the search query`);
     }
   });