Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(http authz): handle unknown content types in responses #13238

Merged
merged 1 commit into from
Jun 13, 2024
Merged

fix(http authz): handle unknown content types in responses #13238

merged 1 commit into from
Jun 13, 2024

Conversation

thalesmg
Copy link
Contributor

@thalesmg thalesmg commented Jun 12, 2024 •
edited
Loading

Fixes https://emqx.atlassian.net/browse/EMQX-12530

Release version: v/e5.7.1

Summary

PR Checklist

Please convert it to a draft if any of the following conditions are not met. Reviewers may skip over until all the items are checked:

  • Added tests for the changes
  • Added property-based tests for code which performs user input validation
  • Changed lines covered in coverage report
  • Change log has been added to changes/(ce|ee)/(feat|perf|fix|breaking)-<PR-id>.en.md files
  • For internal contributor: there is a jira ticket to track this change
  • Created PR to emqx-docs if documentation update is required, or link to a follow-up jira ticket
  • Schema changes are backward compatible

Checklist for CI (.github/workflows) changes

  • If changed package build workflow, pass this action (manual trigger)
  • Change log has been added to changes/ dir for user-facing artifacts update

@thalesmg thalesmg force-pushed the fix-authz-http-content-type-handling-r57-20240612 branch 2 times, most recently from a15cb0a to 329f730 Compare June 12, 2024 13:03
@thalesmg thalesmg marked this pull request as ready for review June 12, 2024 14:21
@thalesmg thalesmg requested review from JimMoen and a team as code owners June 12, 2024 14:21
@thalesmg thalesmg force-pushed the fix-authz-http-content-type-handling-r57-20240612 branch from 329f730 to 2c264d9 Compare June 12, 2024 17:32
keynslug
keynslug approved these changes Jun 13, 2024
View reviewed changes
Copy link
Contributor

@keynslug keynslug left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The bug report's stacktrace points to

emqx/apps/emqx_auth_http/src/emqx_authz_http.erl

Lines 248 to 249 in 6fe8a09

serialize_body(<<"application/json">>, Body) ->
, which looks like another issue: we can't really issue authz request with an arbitrary content type.

I guess the schema is too permissive in the content-type header values, the validator would help but also make the schema backward-incompatible.

@thalesmg
Copy link
Contributor Author

The bug report's stacktrace points to

emqx/apps/emqx_auth_http/src/emqx_authz_http.erl

Lines 248 to 249 in 6fe8a09

serialize_body(<<"application/json">>, Body) ->

, which looks like another issue: we can't really issue authz request with an arbitrary content type.

I guess the schema is too permissive in the content-type header values, the validator would help but also make the schema backward-incompatible.

True. The ticket is a bit confusing because it shows a configuration where the request content-type is application/json, but stacktrace suggests another issue. I found that a response content-type also had a similar crash, so I at least started with this one until a more precise ticket is made. 🙈

@thalesmg thalesmg merged commit 6ccf1dc into emqx:release-57 Jun 13, 2024
175 checks passed
@thalesmg thalesmg deleted the fix-authz-http-content-type-handling-r57-20240612 branch June 13, 2024 12:10
@emqxqa
Copy link

emqxqa commented Jun 18, 2024

TestExecution

@BrewTestBot BrewTestBot mentioned this pull request Jun 26, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@keynslug keynslug keynslug approved these changes

@JimMoen JimMoen Awaiting requested review from JimMoen JimMoen is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@thalesmg @emqxqa @keynslug