Merge pull request #2739 from pallets/2735-abort-debug

Only trap key errors by default in debug, not all BadRequest errors

flask/app.py

@@ -1663,8 +1663,14 @@ class Flask(_PackageBoundObject):
 
         trap_bad_request = self.config['TRAP_BAD_REQUEST_ERRORS']
 
-        # if unset, trap based on debug mode
+        # if unset, trap key errors in debug mode
-        if (trap_bad_request is None and self.debug) or trap_bad_request:
+        if (
+            trap_bad_request is None and self.debug
+            and isinstance(e, BadRequestKeyError)
+        ):
+            return True
+
+        if trap_bad_request:
             return isinstance(e, BadRequest)
 
         return False

tests/test_basic.py

@@ -1027,21 +1027,34 @@ def test_errorhandler_precedence(app, client):
 
 
 def test_trapping_of_bad_request_key_errors(app, client):
-    @app.route('/fail')
+    @app.route('/key')
     def fail():
         flask.request.form['missing_key']
 
-    rv = client.get('/fail')
+    @app.route('/abort')
+    def allow_abort():
+        flask.abort(400)
+
+    rv = client.get('/key')
     assert rv.status_code == 400
     assert b'missing_key' not in rv.data
+    rv = client.get('/abort')
+    assert rv.status_code == 400
 
-    app.config['TRAP_BAD_REQUEST_ERRORS'] = True
+    app.debug = True
-
     with pytest.raises(KeyError) as e:
-        client.get("/fail")
+        client.get("/key")
-
     assert e.errisinstance(BadRequest)
     assert 'missing_key' in e.value.description
+    rv = client.get('/abort')
+    assert rv.status_code == 400
+
+    app.debug = False
+    app.config['TRAP_BAD_REQUEST_ERRORS'] = True
+    with pytest.raises(KeyError):
+        client.get('/key')
+    with pytest.raises(BadRequest):
+        client.get('/abort')
 
 
 def test_trapping_of_all_http_exceptions(app, client):