Re: Exception handling in Spring-MVC/FreeMarker web applications

Wednesday, October 21, 2009, 8:36:05 PM, [email protected] wrote:

> While developing a web application using Spring and FreeMarker I've found
> that exceptions during template processing (caused, for example, by keys
> referenced in the template but missing from the model map) result in stack
> traces being thrown out all the way to the client browser. One of the main
> reasons for migrating away from JSPs (apart from them being inefficient,
> dangerous, difficult to work with, nightmarish to debug, etc., etc., etc.)
> is that JSPs have a nasty tendency to send stack traces to the browser. I
> was really hoping FreeMarker wouldn't do the same thing. The problem
> appears to be that FM sends the stack trace to the same output stream that
> the processed output would normally be sent to, and in a web environment
> that's going to be the response output stream.

The framework authors has *full* control regarding this behavior... We
don't have (unless, they use the
freemarker.ext.servlet.FreemarkerServlet). OK, there is a default
exception handler, which is rather for development/debugging... Maybe
the default should be for production environment, just to be on the
safe-side. OTOH, then developers will complain that why we can't just
print the trace into the browser. You know, someone always hates you,
no mater how you decide... :)

> I need to make sure that one way or another template processing exceptions
> are caught in a way that lets the application (or the View) throw out a
> response.sendError() call (ideally with a configurable error code, but a
> hard-coded '500' error would be acceptable) and log the error trace in the
> server log. At the very least I need a way to make certain that the client
> doesn't see a stack trace, ever, under any circumstances.

(Controlling HTTP response codes is totally out of the reach for the
FreeMarker "core", since it's not HTTP/Servlet dependent.)

> So the question is, does FreeMarker (or the Spring FreeMarkerConfigurer or
> FreeMarkerView) have any kind of configuration setting to cover for this?

Yes, there is a setting called "template_exception_handler" (you can
set it on the same way as "number_format", "locale", etc.). If its
value contains dot, then it is interpreted as class name (of your
exception handler implementation), and the object will be created with
its parameterless constructor. If the value does not contain dot, then
it must be one of these special values: "rethrow", "debug",
"html_debug", "ignore" (case insensitive).

See also:
http://freemarker.org/docs/pgui_config_errorhandling.html
http://freemarker.org/docs/app_faq.html#misc.faq.niceErrorPage.

> I could probably create a proprietary View class that catches the
> exception, but I'd rather stick with the out-of-the-packet code if I
> can.

I hope you don't have to touch the View class... With "rethrow"
FreeMarker itself will not dump the trace into the HTTP response.

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference