cloudfoundry / log-cache

Archived: Now bundled in https://github.com/cloudfoundry/log-cache-release
Apache License 2.0
14 stars 11 forks source link

cf-auth-proxy does not handle whitespace in `/v1/shard_group` body #63

Closed poy closed 5 years ago

poy commented 6 years ago

If I do:

curl -H "Authorization: $TOKEN" localhost:8081/v1/shard_group/xxx -X PUT -d '{"sourceI": ["doppler"]}' -vvv

The gateway (listening on port 8081) responds fine:

* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8083 (#0)
> PUT /v1/shard_group/xxx HTTP/1.1
> User-Agent: curl/7.35.0
> Host: localhost:8083
> Accept: */*
> Authorization: <MY TOKEN>
> Content-Length: 25
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 25 out of 25 bytes
< HTTP/1.1 200 OK
< Content-Length: 2
< Content-Type: application/json
< Date: Thu, 10 May 2018 17:51:45 GMT
<
* Connection #0 to host localhost left intact
{}

However, if I do:

curl -H "Authorization: $TOKEN" localhost:8083/v1/shard_group/xxx -X PUT -d '{"sourceI": ["doppler"]}' -vvv

It returns a 502:

* Hostname was NOT found in DNS cache
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8083 (#0)
> PUT /v1/shard_group/xxx HTTP/1.1
> User-Agent: curl/7.35.0
> Host: localhost:8083
> Accept: */*
> Authorization: <MY TOKEN>
> Content-Length: 26
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 26 out of 26 bytes
< HTTP/1.1 502 Bad Gateway
< Date: Thu, 10 May 2018 17:55:38 GMT
< Content-Length: 0
< Content-Type: text/plain; charset=utf-8
<
* Connection #0 to host localhost left intact
cf-gitbot commented 6 years ago

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/157488542

The labels on this github issue will be updated when the story is started.

jtuchscherer commented 5 years ago

The sharding endpoint is gone, but let's check if this is an issue against other endpoints.

jtuchscherer commented 5 years ago

Closing since we don't have any other http endpoints anymore that accept a body