diff --git a/physical/physical_view.go b/physical/physical_view.go index af5387971c..38c16e51f4 100644 --- a/physical/physical_view.go +++ b/physical/physical_view.go @@ -1,10 +1,14 @@ package physical import ( - "fmt" + "errors" "strings" ) +var ( + ErrRelativePath = errors.New("relative paths not supported") +) + // View represents a prefixed view of a physical backend type View struct { backend Backend @@ -74,7 +78,7 @@ func (v *View) Delete(key string) error { // sanityCheck is used to perform a sanity check on a key func (v *View) sanityCheck(key string) error { if strings.Contains(key, "..") { - return fmt.Errorf("key cannot be relative path") + return ErrRelativePath } return nil } diff --git a/vault/barrier_view.go b/vault/barrier_view.go index 59a0cae3cd..3512aba49f 100644 --- a/vault/barrier_view.go +++ b/vault/barrier_view.go @@ -1,7 +1,7 @@ package vault import ( - "fmt" + "errors" "strings" "github.com/hashicorp/vault/logical" @@ -20,6 +20,10 @@ type BarrierView struct { readonly bool } +var ( + ErrRelativePath = errors.New("relative paths not supported") +) + // NewBarrierView takes an underlying security barrier and returns // a view of it that can only operate with the given prefix. func NewBarrierView(barrier BarrierStorage, prefix string) *BarrierView { @@ -32,7 +36,7 @@ func NewBarrierView(barrier BarrierStorage, prefix string) *BarrierView { // sanityCheck is used to perform a sanity check on a key func (v *BarrierView) sanityCheck(key string) error { if strings.Contains(key, "..") { - return fmt.Errorf("key cannot be relative path") + return ErrRelativePath } return nil } diff --git a/vault/request_handling.go b/vault/request_handling.go index 26fcf01a40..3d97ebb543 100644 --- a/vault/request_handling.go +++ b/vault/request_handling.go @@ -171,6 +171,9 @@ func (c *Core) handleRequest(req *logical.Request) (retResp *logical.Response, r if errType != nil { retErr = multierror.Append(retErr, errType) } + if ctErr == ErrInternalError { + return nil, auth, retErr + } return logical.ErrorResponse(ctErr.Error()), auth, retErr }