search

cloudflare / cloudflare-access-for-atlassian

Authenticate Atlasssian products when using Cloudflare Access
Other
45 stars 15 forks source link

Plugin throws NPE on extra / in attachment URL #24

Closed larcher closed 6 years ago

larcher commented 6 years ago

Noticed several NPE's in the logs, where the referer URL is what appears to be an Activity Stream page on our Jira instance, and the request URL is something like //download/attachments/102826706/user-avatar?version=2&modificationDate=1534869650572&api=v2. Note the // at the beginning. This appears to be a URL generated internally by Jira.

Visiting the URL directly results in a System Error page from Confluence, with the following errror:

Cause
java.lang.RuntimeException: java.lang.RuntimeException: java.lang.NullPointerException
    at com.cloudflare.access.atlassian.base.auth.CloudflareAccessService.processAuthRequest(CloudflareAccessService.java:95)

caused by: java.lang.RuntimeException: java.lang.NullPointerException
    at com.cloudflare.access.atlassian.confluence.auth.ConfluenceSuccessfulAuthenticationRequestHandler.handle(ConfluenceSuccessfulAuthenticationRequestHandler.java:65)

caused by: java.lang.NullPointerException
    at Unknown location

Stack Trace:[hide]
java.lang.RuntimeException: java.lang.RuntimeException: java.lang.NullPointerException
    at com.cloudflare.access.atlassian.base.auth.CloudflareAccessService.processAuthRequest(CloudflareAccessService.java:95)
    at com.cloudflare.access.atlassian.confluence.auth.AuthenticationFilter.doFilter(AuthenticationFilter.java:46)
    at com.atlassian.plugin.servlet.filter.DelegatingPluginFilter.doFilter(DelegatingPluginFilter.java:64)
    at com.atlassian.plugin.servlet.filter.IteratingFilterChain.doFilter(IteratingFilterChain.java:37)
...

Removing one of the initial /s and visiting that URL allows the attachment to be retrieved successfully.

(Checked our Jira config for the Confluence Application Link, the URL has no trailing slash -- just https://wikihostname)

larcher commented 6 years ago

This may be a false alarm, an unrelated issue -- looking farther back in the logs, before the plugin was enabled, I see exceptions for similar URLs but without any mention of CloudflareAccessService in the stack trace.

felipebn commented 6 years ago

Hey Larry,

Can you try the URl with the double slash without the plugin to confirm that the plugin is not related?

The plugin will always appear as part of the stack traces as it's request Filter.

What I will change is that I will not wrap exception down on the chain, I was doing it for log purposes, but after the refactor it doesn't make sense.

I tried an attachment URL on my confluence instance with the double slash and I wasn't able to reproduce it.

felipebn commented 6 years ago

Not wrapping the exception anymore.