Project

General

Profile

Bug #41060

Feature #40907: mgr/dashboard: REST API improvements

mgr/dashboard: REST API returns 500 when no Content-Type is specified

Added by Ernesto Puerta over 1 year ago. Updated 4 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
dashboard/backend
Target version:
% Done:

0%

Source:
Tags:
Backport:
nautilus, octopus
Regression:
No
Severity:
2 - major
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
Crash signature:

Description

Right now, a request like this (without Content-Type: application/json) results in 500 error + traceback:

# curl -s -k -X POST "https://172.20.0.2:11000/api/auth" -d "{\"username\":\"xxx\",\"password\":\"xxxx\"}" 
{
"status":
  "500 Internal Server Error",
"version":
  "3.2.2",
"detail":
  "The server encountered an unexpected condition which prevented it from fulfilling the request.",
"traceback":
  "Traceback (most recent call last):\n  File \"/usr/lib/python2.7/site-packages/cherrypy/_cprequest.py\", line 656, in respond\n
    response.body = self.handler()\n  File \"/usr/lib/python2.7/site-packages/cherrypy/lib/encoding.py\", line 188, in __call__\n
    self.body = self.oldhandler(*args, **kwargs)\n  File \"/usr/lib/python2.7/site-packages/cherrypy/_cptools.py\", line 221, in wrap\n
    return self.newhandler(innerfunc, *args, **kwargs)\n  File \"/ceph/src/pybind/mgr/dashboard/services/exception.py\", line 88, in dashboard_exception_handler\n
    return handler(*args, **kwargs)\n  File \"/usr/lib/python2.7/site-packages/cherrypy/_cpdispatch.py\", line 34, in __call__\n
    return self.callable(*self.args, **self.kwargs)\n  File \"/ceph/src/pybind/mgr/dashboard/controllers/__init__.py\", line 649, in inner\n
    ret = func(*args, **kwargs)\n  File \"/ceph/src/pybind/mgr/dashboard/controllers/__init__.py\", line 842, in wrapper\n
    return func(*vpath, **params)\nTypeError: create() got an unexpected keyword argument '{\"username\":\"xxxx\",\"password\":\"xxxx\"}'\n" 
}

There are 2 issues here:
  • Trying to parse an unsupperted content type can result in an exploit,
  • The proper response according to HTTP 1.1 should be 416 - Unsupported Media Type (blame on client side) instead of 500 - Internal Server Error.

Related issues

Copied to mgr - Backport #47303: nautilus: mgr/dashboard: REST API returns 500 when no Content-Type is specified Resolved
Copied to mgr - Backport #47349: octopus: mgr/dashboard: REST API returns 500 when no Content-Type is specified Resolved

History

#1 Updated by Ernesto Puerta over 1 year ago

  • Description updated (diff)

#2 Updated by Sebastian Wagner over 1 year ago

https://github.com/rook/rook/issues/3873

Traceback (most recent call last):
 File "/usr/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 656, in respond
     response.body = self.handler()
 File "/usr/lib/python2.7/site-packages/cherrypy/lib/encoding.py", line 188, in call
     self.body = self.oldhandler(*args, **kwargs)
 File "/usr/lib/python2.7/site-packages/cherrypy/_cptools.py", line 221, in wrap
     return self.newhandler(innerfunc, *args, **kwargs)
 File "/usr/share/ceph/mgr/dashboard/services/exception.py", line 88, in dashboard_exception_handler
     return handler(*args, **kwargs)
 File "/usr/lib/python2.7/site-packages/cherrypy/_cpdispatch.py", line 34, in call
     return self.callable(*self.args, **self.kwargs)
 File "/usr/share/ceph/mgr/dashboard/controllers/init.py", line 649, in inner
     ret = func(*args, **kwargs)
 File "/usr/share/ceph/mgr/dashboard/controllers/init.py", line 842, in wrapper
     return func(*vpath, **params)
TypeError: create() got an unexpected keyword argument 'stay_signed_in'

#3 Updated by Sebastian Wagner over 1 year ago

  • Status changed from New to 12

#4 Updated by Sebastian Wagner over 1 year ago

  • Backport set to nautilus

#5 Updated by Ernesto Puerta about 1 year ago

  • Parent task set to #40907

#6 Updated by Patrick Donnelly about 1 year ago

  • Status changed from 12 to New

#7 Updated by anurag bandhu 9 months ago

  • Assignee changed from Ernesto Puerta to anurag bandhu

#8 Updated by anurag bandhu 9 months ago

Ernesto Puerta wrote:

Right now, a request like this (without Content-Type: application/json) results in 500 error + traceback:
[...]

There are 2 issues here:
  • Trying to parse an unsupperted content type can result in an exploit,
  • The proper response according to HTTP 1.1 should be 415 - Unsupported Media Type (blame on client side) instead of 500 - Internal Server Error.

#9 Updated by anurag bandhu 9 months ago

  • Status changed from New to Fix Under Review
  • Pull request ID set to 34831

#10 Updated by Alfonso Martínez 6 months ago

  • Status changed from Fix Under Review to In Progress
  • Assignee changed from anurag bandhu to avan thakkar

#11 Updated by Avan Thakkar 5 months ago

  • Status changed from In Progress to Pending Backport

#12 Updated by Avan Thakkar 5 months ago

  • Copied to Backport #47303: nautilus: mgr/dashboard: REST API returns 500 when no Content-Type is specified added

#13 Updated by Ernesto Puerta 5 months ago

  • Backport changed from nautilus to nautilus, octopus

#14 Updated by Nathan Cutler 5 months ago

  • Copied to Backport #47349: octopus: mgr/dashboard: REST API returns 500 when no Content-Type is specified added

#15 Updated by Lenz Grimmer 4 months ago

  • Status changed from Pending Backport to Resolved
  • Target version set to v16.0.0

Also available in: Atom PDF