[FreeMarker-user] Exception handling in Spring-MVC/FreeMarker web applications

Discussion:

P***@blm.gov

2009-10-21 18:36:05 UTC

While developing a web application using Spring and FreeMarker I've found
that exceptions during template processing (caused, for example, by keys
referenced in the template but missing from the model map) result in stack
traces being thrown out all the way to the client browser. One of the main
reasons for migrating away from JSPs (apart from them being inefficient,
dangerous, difficult to work with, nightmarish to debug, etc., etc., etc.)
is that JSPs have a nasty tendency to send stack traces to the browser. I
was really hoping FreeMarker wouldn't do the same thing. The problem
appears to be that FM sends the stack trace to the same output stream that
the processed output would normally be sent to, and in a web environment
that's going to be the response output stream.

I need to make sure that one way or another template processing exceptions
are caught in a way that lets the application (or the View) throw out a
response.sendError() call (ideally with a configurable error code, but a
hard-coded '500' error would be acceptable) and log the error trace in the
server log. At the very least I need a way to make certain that the client
doesn't see a stack trace, ever, under any circumstances.

So the question is, does FreeMarker (or the Spring FreeMarkerConfigurer or
FreeMarkerView) have any kind of configuration setting to cover for this? I
could probably create a proprietary View class that catches the exception,
but I'd rather stick with the out-of-the-packet code if I can.

Newman, John W

2009-10-21 19:13:57 UTC

Permalink

Hi -

Take a look at

configuration.setTemplateExceptionHandler(TemplateExceptionHandler.RETHROW_HANDLER);

RETHROW_HANDLER may not be what you want ... I forget what each does, there are a few different options. But that's the setting you're after

-----Original Message-----
From: ***@blm.gov [mailto:***@blm.gov]
Sent: Wednesday, October 21, 2009 2:36 PM
To: freemarker-***@lists.sourceforge.net
Subject: [FreeMarker-user] Exception handling in Spring-MVC/FreeMarker web applications

While developing a web application using Spring and FreeMarker I've found
that exceptions during template processing (caused, for example, by keys
referenced in the template but missing from the model map) result in stack
traces being thrown out all the way to the client browser. One of the main
reasons for migrating away from JSPs (apart from them being inefficient,
dangerous, difficult to work with, nightmarish to debug, etc., etc., etc.)
is that JSPs have a nasty tendency to send stack traces to the browser. I
was really hoping FreeMarker wouldn't do the same thing. The problem
appears to be that FM sends the stack trace to the same output stream that
the processed output would normally be sent to, and in a web environment
that's going to be the response output stream.

I need to make sure that one way or another template processing exceptions
are caught in a way that lets the application (or the View) throw out a
response.sendError() call (ideally with a configurable error code, but a
hard-coded '500' error would be acceptable) and log the error trace in the
server log. At the very least I need a way to make certain that the client
doesn't see a stack trace, ever, under any circumstances.

So the question is, does FreeMarker (or the Spring FreeMarkerConfigurer or
FreeMarkerView) have any kind of configuration setting to cover for this? I
could probably create a proprietary View class that catches the exception,
but I'd rather stick with the out-of-the-packet code if I can.

P***@blm.gov

2009-10-21 19:58:17 UTC

Permalink

That's great. I think I need either IGNORE_HANDLER or perhaps develop my
own custom handler. Either way, this is the key. Thanks!

Post by Newman, John W
Hi -
Take a look at
configuration.
setTemplateExceptionHandler(TemplateExceptionHandler.RETHROW_HANDLER);
RETHROW_HANDLER may not be what you want ... I forget what each
does, there are a few different options. But that's the setting you're

after

Post by Newman, John W
-----Original Message-----

[snip]

Daniel Dekany

2009-10-21 20:08:39 UTC

Permalink

Post by P***@blm.gov
That's great. I think I need either IGNORE_HANDLER or perhaps develop my
own custom handler. Either way, this is the key. Thanks!

Nah, certainly you want the "rethrow" handler... Unless you want buggy
templates to return a some half-done response without showing any
error message to the user.

Post by P***@blm.gov

after

Post by Newman, John W
-----Original Message-----

[snip]
------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
FreeMarker-user mailing list
https://lists.sourceforge.net/lists/listinfo/freemarker-user

--
Best regards,
Daniel Dekany

Daniel Dekany

2009-10-21 20:02:37 UTC

Permalink

Post by P***@blm.gov
While developing a web application using Spring and FreeMarker I've found
that exceptions during template processing (caused, for example, by keys
referenced in the template but missing from the model map) result in stack
traces being thrown out all the way to the client browser. One of the main
reasons for migrating away from JSPs (apart from them being inefficient,
dangerous, difficult to work with, nightmarish to debug, etc., etc., etc.)
is that JSPs have a nasty tendency to send stack traces to the browser. I
was really hoping FreeMarker wouldn't do the same thing. The problem
appears to be that FM sends the stack trace to the same output stream that
the processed output would normally be sent to, and in a web environment
that's going to be the response output stream.

The framework authors has *full* control regarding this behavior... We
don't have (unless, they use the
freemarker.ext.servlet.FreemarkerServlet). OK, there is a default
exception handler, which is rather for development/debugging... Maybe
the default should be for production environment, just to be on the
safe-side. OTOH, then developers will complain that why we can't just
print the trace into the browser. You know, someone always hates you,
no mater how you decide... :)

Post by P***@blm.gov
I need to make sure that one way or another template processing exceptions
are caught in a way that lets the application (or the View) throw out a
response.sendError() call (ideally with a configurable error code, but a
hard-coded '500' error would be acceptable) and log the error trace in the
server log. At the very least I need a way to make certain that the client
doesn't see a stack trace, ever, under any circumstances.

(Controlling HTTP response codes is totally out of the reach for the
FreeMarker "core", since it's not HTTP/Servlet dependent.)

Post by P***@blm.gov
So the question is, does FreeMarker (or the Spring FreeMarkerConfigurer or
FreeMarkerView) have any kind of configuration setting to cover for this?

Yes, there is a setting called "template_exception_handler" (you can
set it on the same way as "number_format", "locale", etc.). If its
value contains dot, then it is interpreted as class name (of your
exception handler implementation), and the object will be created with
its parameterless constructor. If the value does not contain dot, then
it must be one of these special values: "rethrow", "debug",
"html_debug", "ignore" (case insensitive).

See also:
http://freemarker.org/docs/pgui_config_errorhandling.html
http://freemarker.org/docs/app_faq.html#misc.faq.niceErrorPage.

Post by P***@blm.gov
I could probably create a proprietary View class that catches the
exception, but I'd rather stick with the out-of-the-packet code if I
can.

I hope you don't have to touch the View class... With "rethrow"
FreeMarker itself will not dump the trace into the HTTP response.

--
Best regards,
Daniel Dekany

P***@blm.gov

2009-10-21 20:25:53 UTC

Permalink

Maybe... but if the handler rethrows the exception, what catches it in the
SpringMVC environment? How would my app know to force a 500 error response
back to the client? I'm trying to get my brain round that. I think I need
to experiment a bit.