fix: Server internal error details leaking in error messages returned to clients (#9937)

src/Routers/GraphQLRouter.js

@@ -1,6 +1,7 @@
 import Parse from 'parse/node';
 import PromiseRouter from '../PromiseRouter';
 import * as middleware from '../middlewares';
+import { createSanitizedError } from '../Error';
 
 const GraphQLConfigPath = '/graphql-config';
 
@@ -14,9 +15,9 @@ export class GraphQLRouter extends PromiseRouter {
 
   async updateGraphQLConfig(req) {
     if (req.auth.isReadOnly) {
-      throw new Parse.Error(
+      throw createSanitizedError(
         Parse.Error.OPERATION_FORBIDDEN,
-        "read-only masterKey isn't allowed to update the GraphQL config."
+        "read-only masterKey isn't allowed to update the GraphQL config.",
       );
     }
     const data = await req.config.parseGraphQLController.updateGraphQLConfig(req.body?.params || {});