Bug 50173 - [UDM HTTP API] make /udm/object/ more robust
[UDM HTTP API] make /udm/object/ more robust
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: UDM - REST API
UCS 4.4
Other Linux
: P5 normal (vote)
: ---
Assigned To: Florian Best
UMC maintainers
:
Depends on: 50127
Blocks:
  Show dependency treegraph
 
Reported: 2019-09-10 23:34 CEST by Daniel Tröder
Modified: 2019-10-02 16:06 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 7: Crash: Bug causes crash or data loss
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Tröder univentionstaff 2019-09-10 23:34:59 CEST
+++ This bug was initially created as a clone of Bug #50127 +++

Unknown univentionObjectType create HTTP 500 errors on the server.

I have this object in my LDAP:
-----------------------------------------------
dn: cn=default-admins,cn=admin-settings,cn=users,cn=policies,dc=uni,dc=dtr
objectClass: top
objectClass: univentionPolicy
objectClass: univentionPolicyAdminSettings
objectClass: univentionObject
univentionObjectType: policies/admin_user
univentionAdminMayOverrideSettings: 1
cn: default-admins
emptyAttributes: univentionAdminListWizards
emptyAttributes: univentionAdminListWebModules
-----------------------------------------------

When looking for a redirect at https://m66.uni.dtr/univention/udm/object/cn=default-admins,cn=admin-settings,cn=users,cn=policies,dc=uni,dc=dtr

I receive a HTTP 500 with the following stacktrace:

-----------------------------------------------
HTTP-Error 500:
sequence item 0: expected string or Unicode, NoneType found

Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/tornado/web.py", line 1467, in _execute
    result = method(*self.path_args, **self.path_kwargs)
  File "/usr/lib/pymodules/python2.7/univention/management/modules/udm/module.py", line 1901, in get
    url = self.abspath(module.name, quote_dn(dn))
  File "/usr/lib/pymodules/python2.7/univention/management/modules/udm/module.py", line 737, in abspath
    return urljoin(self.urljoin('/univention/udm/' if self.request.headers.get('X-Forwarded-Host') else '/udm/'), '/'.join(args))
TypeError: sequence item 0: expected string or Unicode, NoneType found
-----------------------------------------------

The situation should be handled in the server. Then a proper response can be sent to the client.
Not sure if it should be 4xx or 5xx.


Another problem:
================

When opening /univention/udm/object/ without any further path arguments, I get a traceback from an unhandled HTTPError exception sent as text/plain:

-----------------------------------------------
root@m66:~# curl -i -X GET -u Administrator:univention -H "Accept:application/json" http://127.0.0.1/univention/udm/object/
HTTP/1.1 404 Not Found
Date: Tue, 10 Sep 2019 21:30:06 GMT
Server: TornadoServer/4.4.3
X-Permitted-Cross-Domain-Policies: master-only
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Length: 294
Content-Type: text/plain
Content-Language: en-US
Via: 1.1 m66.uni.dtr

Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/tornado/web.py", line 1446, in _execute
    result = self.prepare()
  File "/usr/lib/python2.7/dist-packages/tornado/web.py", line 2174, in prepare
    raise HTTPError(self._status_code)
HTTPError: HTTP 404: Not Found
-----------------------------------------------

The 404 is correct, but it should be a application/json response.
Comment 1 Daniel Tröder univentionstaff 2019-09-10 23:57:32 CEST
Another one: univentionObjectType: policies/thinclient
cn=default-settings,cn=thinclient,cn=policies,dc=uni,dc=dtr
Comment 2 Florian Best univentionstaff 2019-09-11 09:34:16 CEST
Fixed in:

univention-management-console-module-udm (9.0.13-1)
fc88f33f58e5 | Bug #50173: improove robustness
Comment 3 Daniel Tröder univentionstaff 2019-09-12 11:13:53 CEST
OK: these 3 URLs now lead to HTTP 404 and an application/json response (with a HTTP 404 message):

* curl -i -k -X GET -u Administrator:univention -H "Accept:application/json" https://m66.uni.dtr/univention/udm/object/
* curl -i -k -X GET -u Administrator:univention -H "Accept:application/json" 'https://m66.uni.dtr/univention/udm/object/cn=default-settings,cn=thinclient,cn=policies,dc=uni,dc=dtr'
* curl -i -k -X GET -u Administrator:univention -H "Accept:application/json" 'https://m66.uni.dtr/univention/udm/object/cn=default-admins,cn=admin-settings,cn=users,cn=policies,dc=uni,dc=dtr'
Comment 4 Florian Best univentionstaff 2019-10-02 16:06:33 CEST
UCS 4.4-2 has been released:
 https://docs.software-univention.de/release-notes-4.4-2-en.html
 https://docs.software-univention.de/release-notes-4.4-2-de.html

If this error occurs again, please use "Clone This Bug".