500 Internal service error on previously-working UKHPI URL

[ijdickinson]

Dave Lockett reports that a customer is trying to access this URL but "receiving no results".

When I tried the link, I got a 500 intenal server error. What's a bit concerning is that I can't see a corresponding Sentry report.

[ijdickinson]

Update: customer is requesting an old (no longer present) GSS code.

This was the update I sent to DaveL:

Thanks for reporting this. I can see what's going on. There are two levels of problem here: your customer is attempting a comparison of the following locations: E07000153 Kettering E07000150 Corby E07000152 East Northamptonshire

Following the changes in Northamptonshire in April, which as you know are now reflected in the UKHPI data, E07000153 and E07000152 are no longer active GSS codes. There isn't data for those locations any more. Your customer will need to create a new comparison using locations that are currently available in UKHPI.

When the app detects an incorrect location, it should be reporting a clear explanation and diagnosis to the user. This isn't happening. Instead, the user only sees a cryptic "500 server error" message. This is clearly a bug, and we'll look at fixing it. However, even when that is fixed, the underlying problem will still remain. UKHPI doesn't have any Kettering data any more, so the best we can manage will be to try to tell the user that as clearly as possible.

The bugs for us to fix are now:

• squash 500 ISE response
• report the problem more clearly and empathetically to the user
• find out why no Sentry alert

[ijdickinson]

Updated framing for this ticket:

Fix description

When I am comparing locations in UKHPI And I am using a bookmarked URL that I've have used successfully before And it is the case that one or more location codes in the URL are no-longer valid Then I should see a usefully explanatory error message to explain that my locations are invalid

Business justification

Customer reported problem on supported application

Definition of done

• [ ] a compare-controller path that includes GSS-Style-codes (see example below) does not generate a cryptic 500 Internal Server Error
• [ ] a compare-controller path that includes GSS-Style-codes (see example below) should give as helpful an error explanation to the user as possible
• [ ] a compare-controller path that includes random nonsense should be sanitised before appearing as part of an error page (to avoid XSS attacks)
• [ ] both of the preceding problems should generate a low-priority (warn or info) log message but no Sentry alert
• [ ] any genuine internal server error should generate both an error-level log message, and a Sentry alert

Example path

/compare?in=hpi&location[]=E07000153&location[]=E07000150&location[]=E07000152&st=all

Location GSS codes ...153 and ...152 are not valid, and no data exists for them in UKHPI.

Development tasks

• [ ] identify if the current 500 ISE is not getting to Sentry and fix by throwing an error
• [ ] change the catcher for illegal location codes app/models/user_compare_selections.rb:43 to give a more user-helpful error response. In particular, something that looks like a GSS code, but is not recognised, should get a custom error response
• [ ] Check that user input should be scrubbed before being interpolated into the error page, to prevent XSS/script injection attacks
• [ ] check that a "normal" case of unrecognised input only generates a log message below error severity

Estimate 2 days