Issue #7066
closed
Denial of Service in pulp-content when CONTENT_PATH_PREFIX is followed by a `/`
Description
when sending a request to ${CONTENT_PATH_PREFIX}/ (whatever CONTENT_PATH_PREFIX is set to, plus one extra slash) pulp-content enters an infinite loop. because:
>>> os.path.split('/path')
('/', 'path')
>>> os.path.split('/')
('/', '')
and hence the while loop in https://github.com/pulp/pulpcore/blob/master/pulpcore/content/handler.py#L152-L158 never reaches the exit condition of base being empty (it stays /)
Updated by SimonPe over 4 years ago
Updated by daviddavis over 4 years ago
I was able to reproduce this:
$ http :/pulp/content//
The content app hung for a while and then I saw this in the logs:
Jul 02 19:48:20 pulp3-source-fedora.crake.example.com gunicorn[28299]: [2020-07-02 19:48:20 +0000] [28299] [CRITICAL] WORKER TIMEOUT (pid:28312)
Jul 02 19:48:21 pulp3-source-fedora.crake.example.com gunicorn[28299]: [2020-07-02 19:48:21 +0000] [28337] [INFO] Booting worker with pid: 28337
Updated by fao89 over 4 years ago
- Triaged changed from No to Yes
- Sprint set to Sprint 76
Updated by daviddavis over 4 years ago
- Status changed from NEW to POST
- Assignee set to SimonPe
Added by SimonPe over 4 years ago
Updated by SimonPe over 4 years ago
- Status changed from POST to MODIFIED
Applied in changeset pulpcore|244988496900843a412e42ebff95468a4e682635.
Added by SimonPe over 4 years ago
Revision 19d9e6ac | View on GitHub
don't go into an infinite loop when CONTENT_PATH_PREFIX is followed by /
this would cause path to start with a /
and because
>>> os.path.split('/path')
('/', 'path')
>>> os.path.split('/')
('/', '')
base would never end up as None but stay as / resulting in an infinite loop.
fixes #7066
(cherry picked from commit 244988496900843a412e42ebff95468a4e682635)
Updated by pulpbot over 4 years ago
- Status changed from MODIFIED to CLOSED - CURRENTRELEASE
.
don't go into an infinite loop when
CONTENT_PATH_PREFIXis followed by/this would cause
pathto start with a/and becausebasewould never end up asNonebut stay as/resulting in an infinite loop.fixes #7066