Issues with URL encoded ControllerIDs

Aperta
  • Qualcosa non va?
#1,135 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
30/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
java, spring
Ambito
api

Direzione di ricerca

Start by tracing how ControllerIDs are handled in the DDI API and Management API, then read the Spring Security StrictHttpFirewall configuration mentioned in the stack trace. Check existing tests for target creation and polling; done means both APIs handle URL-encoded ControllerIDs consistently and the behavior is covered by tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement feature request

Hi!

I'm using the hawkbit/hawkbit-update-server:latest docker container.
There seem to be some issues/inconsistencies with URL encoded ControllerIDs:

  1. Creating a target with ControllerID * works (management API).
    Polling this target via the DDI API:
  • Not URL encoded:
$ curl -H "Authorization: TargetToken 50aea537bce197fa3371215fbdc5f3c6" "http://localhost:8080/DEFAULT/controller/v1/*"
{"config":{"polling":{"sleep":"00:00:30"}},"_links":{"configData":{"href":"http://localhost:8080/DEFAULT/controller/v1/*/configData"}}}
  • URL encoded:
$ curl -v -H "Authorization: TargetToken 50aea537bce197fa3371215fbdc5f3c6" "http://localhost:8080/DEFAULT/controller/v1/%2A"
[...]
< HTTP/1.1 401 Unauthorized
[...]
  1. Creating a target with ControllerID ö works (management API).
    Polling this target via the DDI API:
  • Not URL encoded:
$ curl -v -H "Authorization: TargetToken da8935abe0960f7062c833fab173c6ee" "http://localhost:8080/DEFAULT/controller/v1/ö"
[...]
< HTTP/1.1 500 Server Error
[...]
{"timestamp":"2021-07-01T14:09:32.684+00:00","status":500,"error":"Internal Server Error","message":""}

hawkBit's logs tell us:

org.springframework.security.web.firewall.RequestRejectedException: The requestURI was rejected because it can only contain printable ASCII characters.
	at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:345)
	at org.eclipse.hawkbit.autoconfigure.security.SecurityManagedConfiguration$UISecurityConfigurationAdapter$IgnorePathsStrictHttpFirewall.getFirewalledRequest(SecurityManagedConfiguration.java:769)
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)
        [...]
  • URL encoded:
$ curl -v -H "Authorization: TargetToken da8935abe0960f7062c833fab173c6ee" "http://localhost:8080/DEFAULT/controller/v1/%C3%B6"
[...]
< HTTP/1.1 401 Unauthorized
[...]

So we can obviously create targets that cannot poll the DDI API, right?

But maybe if we create the target with a URL encoded ControllerID?

  1. Creating a target with ControllerID %C3%B6 works (management API).
    Polling this target via the DDI API:
  • URL encoded:
$ curl -H "Authorization: TargetToken 920e8c8b58619c836efc47960422c5e2" "http://localhost:8080/DEFAULT/controller/v1/%C3%B6"
{"config":{"polling":{"sleep":"00:00:30"}},"_links":{"configData":{"href":"http://localhost:8080/DEFAULT/controller/v1/%C3%B6/configData"}}}

So this works. But now there is a new target "ö" listed in the Web UI:

Status registered
Description: Plug and Play target: ö
Last poll: Thu Jul 1 16:16:56 CEST 2021
Security token: 1e9f7827e9d6bab45ac8d8d0cbc26aed
Created by: CONTROLLER_PLUG_AND_PLAY
[...]

plugnplaytarget
The URL encoded target %C3%B6 is not marked as registered, "Last poll" is empty, although it's security token (TargetToken) was accepted. Is this intended behavior?

Expected behavior: It would be nice to know which characters are allowed in the ControllerID. Ideally they should be accepted URL encoded. And the DDI API as well as the Management API should accept/deny them consistently.

Lingua principale
Java
Stelle
601
Fork
228
Merge medio
15h 48m
PR unite (30g)
62

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di eclipse-hawkbit/hawkbit

Tutte le issue di eclipse-hawkbit/hawkbit

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.