search

plone / plone.protect

HTTP protection utilities for the Plone CMS
https://pypi.org/project/plone.protect/
7 stars 8 forks source link

UnicodeDecodeError checking keyring when migration from 4.3 to 5.2 #93

Open mauritsvanrees opened 3 years ago

mauritsvanrees commented 3 years ago

While updating a site from Plone 4.3 to 5.2, still on Python 2.7 during migration, I get this error:

2020-10-13 16:30:45,892 ERROR   [plone.protect:222][waitress-2] Error checking for CSRF. Transaction will be aborted since the request is now unsafe:
Traceback (most recent call last):
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/auto.py", line 216, in check
    return self._check()
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/auto.py", line 243, in _check
    check(self.request, manager=self.key_manager)
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/authenticator.py", line 125, in check
    name=name, manager=manager):
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/authenticator.py", line 87, in _verify_request
    correct = hmac.new(key.encode('utf-8'), user + extra, sha).hexdigest()
UnicodeDecodeError: 'ascii' codec can't decode byte 0xdf in position 1: ordinal not in range(128)

2020-10-13 16:30:45,892 ERROR   [plone.transformchain:70][waitress-2] Unexpected error whilst trying to apply transform chain
Traceback (most recent call last):
  File "/Users/fred/.buildout/eggs/plone.transformchain-2.0.2-py2.7.egg/plone/transformchain/transformer.py", line 59, in __call__
    newResult = handler.transformIterable(result, encoding)
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/auto.py", line 191, in transformIterable
    if not self.check():
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/auto.py", line 216, in check
    return self._check()
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/auto.py", line 243, in _check
    check(self.request, manager=self.key_manager)
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/authenticator.py", line 125, in check
    name=name, manager=manager):
  File "/Users/fred/.buildout/eggs/plone.protect-4.1.5-py2.7.egg/plone/protect/authenticator.py", line 87, in _verify_request
    correct = hmac.new(key.encode('utf-8'), user + extra, sha).hexdigest()
UnicodeDecodeError: 'ascii' codec can't decode byte 0xdf in position 1: ordinal not in range(128)

I wonder if this happens more often when migrating from Plone 4 to 5.2, but I would have expected more reports by now. Looks like clearing the secrets in Plone 4 helps.

We could catch the UnicodeDecodeError in plone.protect and ignore this key. Or be smart in only calling encode when needed. I have not dived into this yet, so if someone else wants to pick this up, that is fine with me.