HXSecurity / DongTai

Dongtai IAST is an open-source Interactive Application Security Testing (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation. It is particularly suitable for use in the testing phase of the development pipeline.
https://dongtai.io
Apache License 2.0
1.24k stars 145 forks source link

[Bug]: /api/v1/report/upload 接口返回502错误 #190

Closed vboomshaka closed 2 years ago

vboomshaka commented 3 years ago

Preflight Checklist

Version

1.0.3

Installation Type

Official Docker Compose

Service Name

DongTai-OpenAPI

Describe the details of the bug and the steps to reproduce it

agent上报信息接口http://xx.xx.xx.xx:8000/api/v1/report/upload报错 log.txt ,报错信息如下: 2021-09-06 15:27:27.428 [cn.huoxian.dongtai.engine] ERROR report error reason: java.io.IOException: Server returned HTTP response code: 500 for URL: http://xx.xx.xx.xx:8000/api/v1/report/upload at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1932) at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1528) at com.secnium.iast.core.util.HttpClientUtils.sendRequest(HttpClientUtils.java:104) at com.secnium.iast.core.util.HttpClientUtils.sendPost(HttpClientUtils.java:54) at com.secnium.iast.core.report.HeartBeatSender.run(HeartBeatSender.java:85) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305) at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) at java.base/java.lang.Thread.run(Thread.java:832) 2021-09-06 15:27:32.607 [cn.huoxian.dongtai.engine] ERROR report error reason: java.io.IOException: Server returned HTTP response code: 500 for URL: http://xx.xx.xx.xx:8000/api/v1/report/upload at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1932) at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1528) at com.secnium.iast.core.util.HttpClientUtils.sendRequest(HttpClientUtils.java:104) at com.secnium.iast.core.util.HttpClientUtils.sendPost(HttpClientUtils.java:54) at com.secnium.iast.core.report.HeartBeatSender.run(HeartBeatSender.java:85) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305) at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)

openapi容器日志返回无异常 类似返回如下: [pid: 7|app: 0|req: 3807/5306] 10.14.11.103 () {42 vars in 628 bytes} [Tue Sep 7 03:48:08 2021] POST /api/v1/report/upload => generated 60 bytes in 29 msecs (HTTP/1.1 200) 7 headers in 193 bytes (1 switches on core 2) INFO 2021-09-07 03:48:13,996 [report_handler_interface.handle:66] [HeartBeatHandler]报告解析开始 INFO 2021-09-07 03:48:14,014 [report_handler_interface.handle:73] [HeartBeatHandler]报告解析完成 INFO 2021-09-07 03:48:14,018 [heartbeat_handler.get_result:85] 重放请求不存在 INFO 2021-09-07 03:48:14,021 [heartbeat_handler.get_result:105] 重放请求下发成功 [pid: 7|app: 0|req: 3808/5307] 10.14.11.103 () {42 vars in 628 bytes} [Tue Sep 7 03:48:13 2021] POST /api/v1/report/upload => generated 60 bytes in 41 msecs (HTTP/1.1 200) 7 headers in 193 bytes (1 switches on core 7) INFO 2021-09-07 03:48:19,085 [report_handler_interface.handle:66] [HeartBeatHandler]报告解析开始 INFO 2021-09-07 03:48:19,095 [report_handler_interface.handle:73] [HeartBeatHandler]报告解析完成 INFO 2021-09-07 03:48:19,097 [heartbeat_handler.get_result:85] 重放请求不存在 INFO 2021-09-07 03:48:19,099 [heartbeat_handler.get_result:105] 重放请求下发成功 [pid: 7|app: 0|req: 3809/5308] 10.14.11.103 () {42 vars in 627 bytes} [Tue Sep 7 03:48:19 2021] POST /api/v1/report/upload => generated 60 bytes in 24 msecs (HTTP/1.1 200) 7 headers in 193 bytes (1 switches on core 0) INFO 2021-09-07 03:48:24,150 [report_handler_interface.handle:66] [HeartBeatHandler]报告解析开始 INFO 2021-09-07 03:48:24,166 [report_handler_interface.handle:73] [HeartBeatHandler]报告解析完成 INFO 2021-09-07 03:48:24,170 [heartbeat_handler.get_result:85] 重放请求不存在 INFO 2021-09-07 03:48:24,173 [heartbeat_handler.get_result:105] 重放请求下发成功 [pid: 7|app: 0|req: 3810/5309] 10.14.11.103 () {42 vars in 628 bytes} [Tue Sep 7 03:48:24 2021] POST /api/v1/report/upload => generated 60 bytes in 37 msecs (HTTP/1.1 200) 7 headers in 193 bytes (1 switches on core 6) INFO 2021-09-07 03:48:29,220 [report_handler_interface.handle:66] [HeartBeatHandler]报告解析开始 INFO 2021-09-07 03:48:29,237 [report_handler_interface.handle:73] [HeartBeatHandler]报告解析完成 INFO 2021-09-07 03:48:29,241 [heartbeat_handler.get_result:85] 重放请求不存在 INFO 2021-09-07 03:48:29,244 [heartbeat_handler.get_result:105] 重放请求下发成功 [pid: 7|app: 0|req: 3811/5310] 10.14.11.103 () {42 vars in 628 bytes} [Tue Sep 7 03:48:29 2021] POST /api/v1/report/upload => generated 60 bytes in 44 msecs (HTTP/1.1 200) 7 headers in 193 bytes (1 switches on core 1)

Additional Information

No response

Logs

No response

Nizernizer commented 3 years ago

Thanks for the feedback, the test recurrence has been arranged.

exexute commented 3 years ago

Please upload the relevant data report of the interface 500 to facilitate our investigation; or directly submit the 500 exception log of the openapi service.

Bidaya0 commented 3 years ago

502 error is usually associated with nginx and uswgi, please check the relevant configuration.

vboomshaka commented 3 years ago

openapi.log image

感谢

Bidaya0 commented 3 years ago

openapi.log image

This should be an 401 unauthorized, maybe you should post the nginx or uswgi logs to locate the 502