search

ansible / django-ansible-base

Apache License 2.0
18 stars 44 forks source link

validate_x_trusted_proxy_header raises error if value has non-hex number #453

Open chrismeyersfsu opened 4 months ago

chrismeyersfsu commented 4 months ago

Bug Summary

Steps to recreate

Expected

Not to get a 500

Actual

500

  File "/awx_devel/awx/api/generics.py", line 164, in initialize_request
    if validate_x_trusted_proxy_header(request.META['HTTP_X_TRUSTED_PROXY']):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/ansible_base/jwt_consumer/common/util.py", line 43, in validate_x_trusted_proxy_header
    bytes.fromhex(signature),
    ^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: non-hexadecimal number found in fromhex() arg at position 2

More info

https://github.com/ansible/django-ansible-base/blob/01c7f98bc9829a296fe6b1985bb7cf7674e50947/ansible_base/jwt_consumer/common/util.py#L43

AlanCoding commented 4 months ago

So with the linked fix, this is expected to issue a log instead of returning a 500 error.

What is the behavior expectation for the request? The return False means that the header is "not validated". Where is this used from?

https://github.com/ansible/django-ansible-base/blob/b96b1073391a4fc963233e84015f8e4cbfb2ec55/ansible_base/lib/utils/requests.py#L32-L34

So these headers won't get added when the signature isn't valid...