Database/Table/Row not found errors echo back text from URL

[simonw]

This was raised in Discord. The returned error message is escaped, so this isn't an XSS error, but it could still be used to create a confusing error message like so:

[simonw]

Code at fault:

datasette/datasette/app.py

Lines 1615 to 1622 in 93534fd

	async def resolve_database(self, request):
	database_route = tilde_decode(request.url_vars["database"])
	try:
	return self.get_database(route=database_route)
	except KeyError:
	raise DatabaseNotFound(
	"Database not found: {}".format(database_route), database_route
	)

[simonw]

I'm going to remove the reflected database name entirely:

[simonw]

Same bug exists for tables:

[simonw]

... and row not found too:

[simonw]

The fix for 0.64.x looks different because the code is older.

[simonw]

Fix is deployed on latest.datasette.io now:

• https://latest.datasette.io/database-does-not-exist
• https://latest.datasette.io/fixtures/table-does-not-exist
• https://latest.datasette.io/fixtures/facetable/row-does-not-exist

[simonw]

Shipped in 0.64.8: https://docs.datasette.io/en/stable/changelog.html#v0-64-8

It's live in Datasette Lite already:

https://lite.datasette.io/#/content/this+will+not+be+displayed