SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.34k stars 156 forks source link

com.mongodb.MongoGridFSException #237

Open cwiph opened 1 year ago

cwiph commented 1 year ago

Describe the bug There seems to be an error in the handling of execution artifacts.

To Reproduce Steps to reproduce the behavior:

  1. Unfortunately I am not entirely sure how I managed to break the execution artifacts. So the below steps are what cause the exception. However, this does not corrupt the artifact. I assume it might be cause I uploaded it via a TestCase and then deleted the test case and created the exact same one again.
  2. Browse to /sra-purpletools-webui/app/#/app/executionArtifacts
  3. Try to upload an artifact
  4. See screenshots

Expected behavior The execution artifact is created.

Screenshots I search for a specific artifact that used to be in VECTR. The search return no results. no_results

When I try to create the artifact VECTR informs me that it already exists. However, there seems to be already some inconsistency since the search did not find the artifact. duplicate

When I try to overwrite the artifact the following error is displayed: failure

Additional context

Output from docker logs vectr-tomcat_1

com.mongodb.MongoWriteException: Write operation error on server vectr-mongo:27017. Write error: WriteError{code=11000, message='E11000 duplicate key error collection: GoldStandard.ExecutionArtifacts.chunks index: files_id_1_n_1 dup key: { files_id: "868a19a5-38ad-3d26-85aa-78290ad31e12", n: 0 }', details={}}.
    at com.mongodb.client.internal.MongoCollectionImpl.executeSingleWriteRequest(MongoCollectionImpl.java:1033)
    at com.mongodb.client.internal.MongoCollectionImpl.executeInsertOne(MongoCollectionImpl.java:476)
    at com.mongodb.client.internal.MongoCollectionImpl.insertOne(MongoCollectionImpl.java:459)
    at com.mongodb.client.internal.MongoCollectionImpl.insertOne(MongoCollectionImpl.java:453)
    at com.mongodb.client.gridfs.GridFSUploadStreamImpl.writeChunk(GridFSUploadStreamImpl.java:161)
    at com.mongodb.client.gridfs.GridFSUploadStreamImpl.close(GridFSUploadStreamImpl.java:144)
    at com.sra.vectr.libs.mongodb.MongoDbConnection.saveGenericData(MongoDbConnection.java:130)
    at com.sra.vectr.model.poji.executionartifact.ExecutionArtifactInfoDAO.addNew(ExecutionArtifactInfoDAO.java:50)
    at com.sra.vectr.rest.service.task.rta.AddExecutionArtifactTask.runTask(AddExecutionArtifactTask.java:48)
    at com.sra.vectr.rest.service.task.rta.AddExecutionArtifactTask.runTask(AddExecutionArtifactTask.java:15)
    at com.sra.vectr.rest.service.task.SraWebServiceTask.run(SraWebServiceTask.java:75)
    at com.sra.vectr.rest.service.impl.ExecutionArtifactResource.uploadExecutionArtifact(ExecutionArtifactResource.java:40)
    at jdk.internal.reflect.GeneratedMethodAccessor420.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.base/java.lang.reflect.Method.invoke(Unknown Source)
    at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:179)
    at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:103)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265)
    at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:233)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:207)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:159)
    at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:224)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:303)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:216)
    at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:590)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:278)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:205)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at com.sra.vectr.libs.servlet.filters.CharacterSetFilter.doFilter(CharacterSetFilter.java:15)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at com.sra.vectr.libs.servlet.filters.CacheControlFilter.doFilter(CacheControlFilter.java:42)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:676)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:894)
    at org.apache.tomcat.util.net.Nio2Endpoint$SocketProcessor.doRun(Nio2Endpoint.java:1664)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
    at org.apache.tomcat.util.net.AbstractEndpoint.processSocket(AbstractEndpoint.java:1219)
    at org.apache.tomcat.util.net.Nio2Endpoint$Nio2SocketWrapper$2.completed(Nio2Endpoint.java:630)
    at org.apache.tomcat.util.net.Nio2Endpoint$Nio2SocketWrapper$2.completed(Nio2Endpoint.java:608)
    at org.apache.tomcat.util.net.SecureNio2Channel$1.completed(SecureNio2Channel.java:1006)
    at org.apache.tomcat.util.net.SecureNio2Channel$1.completed(SecureNio2Channel.java:934)
    at java.base/sun.nio.ch.Invoker.invokeUnchecked(Unknown Source)
    at java.base/sun.nio.ch.Invoker$2.run(Unknown Source)
    at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(Unknown Source)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Unknown Source)
com.mongodb.MongoGridFSException: No file found with the id: BsonString{value='179c3436-3ef6-38ba-a700-6e2cf271211a'}
    at com.mongodb.client.gridfs.GridFSBucketImpl.executeDelete(GridFSBucketImpl.java:403)
    at com.mongodb.client.gridfs.GridFSBucketImpl.delete(GridFSBucketImpl.java:378)
    at com.sra.vectr.libs.mongodb.MongoDbConnection.deleteGenericData(MongoDbConnection.java:139)
    at com.sra.vectr.businesslogic.cleanup.impl.ExecutionArtifactCleanup.performDeletion(ExecutionArtifactCleanup.java:83)
    at com.sra.vectr.rest.service.PerformDeleteService.performDelete(PerformDeleteService.java:21)
    at com.sra.vectr.rest.service.task.rta.DeleteExecutionArtifactTask.runTask(DeleteExecutionArtifactTask.java:34)
    at com.sra.vectr.rest.service.task.rta.DeleteExecutionArtifactTask.runTask(DeleteExecutionArtifactTask.java:12)
    at com.sra.vectr.rest.service.task.SraWebServiceTask.run(SraWebServiceTask.java:75)
    at com.sra.vectr.rest.service.impl.ExecutionArtifactResource.deleteRecord(ExecutionArtifactResource.java:50)
    at jdk.internal.reflect.GeneratedMethodAccessor579.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.base/java.lang.reflect.Method.invoke(Unknown Source)
    at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:179)
    at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:103)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265)
    at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:233)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:207)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:159)
    at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:224)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:303)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doDelete(AbstractHTTPServlet.java:227)
    at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:596)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:278)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:205)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at com.sra.vectr.libs.servlet.filters.CharacterSetFilter.doFilter(CharacterSetFilter.java:15)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at com.sra.vectr.libs.servlet.filters.CacheControlFilter.doFilter(CacheControlFilter.java:42)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:676)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:390)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:894)
    at org.apache.tomcat.util.net.Nio2Endpoint$SocketProcessor.doRun(Nio2Endpoint.java:1664)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
    at org.apache.tomcat.util.net.AbstractEndpoint.processSocket(AbstractEndpoint.java:1219)
    at org.apache.tomcat.util.net.Nio2Endpoint$Nio2SocketWrapper$2.completed(Nio2Endpoint.java:630)
    at org.apache.tomcat.util.net.Nio2Endpoint$Nio2SocketWrapper$2.completed(Nio2Endpoint.java:608)
    at org.apache.tomcat.util.net.SecureNio2Channel$1.completed(SecureNio2Channel.java:1006)
    at org.apache.tomcat.util.net.SecureNio2Channel$1.completed(SecureNio2Channel.java:934)
    at java.base/sun.nio.ch.Invoker.invokeUnchecked(Unknown Source)
    at java.base/sun.nio.ch.Invoker$2.run(Unknown Source)
    at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(Unknown Source)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Unknown Source)
cwiph commented 1 year ago

Update: it turns out that I am also not able to download the actual artifact. The artifact 9e2f4f87-50d8-3038-ae79-a990da460c38 is a text file. However, a download results in some encrypted binary blob:

bash$ curl -k 'https://vectr-internal:8081/sra-purpletools-rest/files/getExecArtifact/9e2f4f87-50d8-3038-ae79-a990da460c38' -H 'User-Agent: foo' -H 'Accept: application/json, text/plain, */*' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Connection: keep-alive' -H 'Referer: https://vectr-internal:8081/sra-purpletools-webui/app/' -H 'Cookie: vectr_jwt=ey_snip; vectr_refreshToken=b_snip' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' --output artifact.bin

< HTTP/1.1 200 
< Strict-Transport-Security: max-age=31536000
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Expires: Wed, 27 Jun 2012 05:15:00 GMT
< Last-Modified: Wed, 07 Jun 2023 12:28:09 GMT
< Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
< Content-Disposition: attachment; filename=test.txt
< Date: Wed, 07 Jun 2023 12:28:09 GMT
< Content-Type: application/octet-stream;charset=UTF-8
< Content-Length: 1669
< Keep-Alive: timeout=60
< Connection: keep-alive
< 
{ [1669 bytes data]

bash$ xxd artifact.bin | head
00000000: 32fb 7922 d7ad 4a65 850d ed08 f60c 1b88  2.y"..Je........
00000010: 2395 a70d 15ae ce5b 39ab 1148 49ac 4119  #......[9..HI.A.
00000020: ba09 cc18 5430 2386 59b3 24d3 ffc4 a7cd  ....T0#.Y.$.....
00000030: 2b4e c95e 1de3 3e33 dead a3a9 1a43 7cf7  +N.^..>3.....C|.
doodleincode commented 1 year ago

Update: it turns out that I am also not able to download the actual artifact. The artifact 9e2f4f87-50d8-3038-ae79-a990da460c38 is a text file. However, a download results in some encrypted binary blob:

bash$ curl -k 'https://vectr-internal:8081/sra-purpletools-rest/files/getExecArtifact/9e2f4f87-50d8-3038-ae79-a990da460c38' -H 'User-Agent: foo' -H 'Accept: application/json, text/plain, */*' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Connection: keep-alive' -H 'Referer: https://vectr-internal:8081/sra-purpletools-webui/app/' -H 'Cookie: vectr_jwt=ey_snip; vectr_refreshToken=b_snip' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' --output artifact.bin

< HTTP/1.1 200 
< Strict-Transport-Security: max-age=31536000
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Expires: Wed, 27 Jun 2012 05:15:00 GMT
< Last-Modified: Wed, 07 Jun 2023 12:28:09 GMT
< Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
< Content-Disposition: attachment; filename=test.txt
< Date: Wed, 07 Jun 2023 12:28:09 GMT
< Content-Type: application/octet-stream;charset=UTF-8
< Content-Length: 1669
< Keep-Alive: timeout=60
< Connection: keep-alive
< 
{ [1669 bytes data]

bash$ xxd artifact.bin | head
00000000: 32fb 7922 d7ad 4a65 850d ed08 f60c 1b88  2.y"..Je........
00000010: 2395 a70d 15ae ce5b 39ab 1148 49ac 4119  #......[9..HI.A.
00000020: ba09 cc18 5430 2386 59b3 24d3 ffc4 a7cd  ....T0#.Y.$.....
00000030: 2b4e c95e 1de3 3e33 dead a3a9 1a43 7cf7  +N.^..>3.....C|.

This is expected behavior. The file is decoded in the browser, so hitting the API directly will just return a binary formatted blob.

We'll look into the other issue that you mentioned. We're a bit backed up with prior work at the moment, but will add this to our triage queue.

cwiph commented 1 year ago

Update: it turns out that I am also not able to download the actual artifact. The artifact 9e2f4f87-50d8-3038-ae79-a990da460c38 is a text file. However, a download results in some encrypted binary blob:

bash$ curl -k 'https://vectr-internal:8081/sra-purpletools-rest/files/getExecArtifact/9e2f4f87-50d8-3038-ae79-a990da460c38' -H 'User-Agent: foo' -H 'Accept: application/json, text/plain, */*' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Connection: keep-alive' -H 'Referer: https://vectr-internal:8081/sra-purpletools-webui/app/' -H 'Cookie: vectr_jwt=ey_snip; vectr_refreshToken=b_snip' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-origin' --output artifact.bin

< HTTP/1.1 200 
< Strict-Transport-Security: max-age=31536000
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Expires: Wed, 27 Jun 2012 05:15:00 GMT
< Last-Modified: Wed, 07 Jun 2023 12:28:09 GMT
< Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
< Content-Disposition: attachment; filename=test.txt
< Date: Wed, 07 Jun 2023 12:28:09 GMT
< Content-Type: application/octet-stream;charset=UTF-8
< Content-Length: 1669
< Keep-Alive: timeout=60
< Connection: keep-alive
< 
{ [1669 bytes data]

bash$ xxd artifact.bin | head
00000000: 32fb 7922 d7ad 4a65 850d ed08 f60c 1b88  2.y"..Je........
00000010: 2395 a70d 15ae ce5b 39ab 1148 49ac 4119  #......[9..HI.A.
00000020: ba09 cc18 5430 2386 59b3 24d3 ffc4 a7cd  ....T0#.Y.$.....
00000030: 2b4e c95e 1de3 3e33 dead a3a9 1a43 7cf7  +N.^..>3.....C|.

This is expected behavior. The file is decoded in the browser, so hitting the API directly will just return a binary formatted blob.

We'll look into the other issue that you mentioned. We're a bit backed up with prior work at the moment, but will add this to our triage queue.

The web request was sent by the UI originally. Binary blob is returned and then not downloaded by the browser. Thanks for looking into it

cwiph commented 1 year ago

The actual error thrown in the web browser console is:

services.dist.bd4e76004e9137873a65.js:83 Error: wrong secret key for the given ciphertext
    at _ (sodium.js:1:524672)
    at Object.gg [as crypto_secretbox_open_easy] (sodium.js:1:563865)
    at services.dist.bd4e76004e9137873a65.js:83:97758
    at angular.js:18075:37
    at m.$digest (angular.js:19242:15)
    at angular.js:19562:15
    at Yg.completeTask (angular.js:21403:7)
    at angular.js:6879:7
(anonymous) @ services.dist.bd4e76004e9137873a65.js:83