Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of treat logical.ErrRelativePath as 400 instead of 500 into release/1.8.x #14779

Merged
merged 5 commits into from Mar 30, 2022

Conversation

hc-github-team-secure-vault-core
Copy link
Collaborator

Backport

This PR is auto-generated from #14328 to be assessed for backporting due to the inclusion of the label backport/1.8.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

The below text is copied from the body of the original PR.


The userpass auth backend may return a 500 Internal Server Error to attempts to read or write usernames that contain ... The underlying cause is a check performed in StorageView. SanityCheck. It is theoretically possible for other endpoints to result in a 500 response for a path that contains ... The policies endpoints, for example sys/policies/acl/:path, have their own error handling which results in returning a 400 for various errors:

❯ bin/vault read sys/policies/acl/foo..bar
Error reading sys/policies/acl/foo..bar: Error making API request.

URL: GET http://127.0.0.1:8200/v1/sys/policies/acl/foo..bar
Code: 400. Errors:

* failed to read policy: relative paths not supported

The proposed fix is to treat logical.ErrRelativePath as a 400. Rather than do this directly within the userpass logic, it is done at a higher level in the request handling logic so that it has broad coverage across any backend.

❯ bin/vault read auth/userpass/users/foo..bar
Error reading auth/userpass/users/foo..bar: Error making API request.

URL: GET http://127.0.0.1:8200/v1/auth/userpass/users/foo..bar
Code: 400. Errors:

* 1 error occurred:
        * relative paths not supported

@hashicorp-cla
Copy link

hashicorp-cla commented Mar 30, 2022

CLA assistant check
All committers have signed the CLA.

@vercel vercel bot temporarily deployed to Preview – vault-storybook March 30, 2022 13:08 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 30, 2022 13:08 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 30, 2022 13:21 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 30, 2022 13:21 Inactive
Copy link
Contributor

@swayne275 swayne275 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it looks like api is undefined in http/logical_test.go here

@vercel vercel bot temporarily deployed to Preview – vault-storybook March 30, 2022 18:09 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 30, 2022 18:09 Inactive
@ccapurso ccapurso force-pushed the backport/vault-4243/slowly-humble-leopard branch from 1782538 to 1a882ae Compare March 30, 2022 18:10
@vercel vercel bot temporarily deployed to Preview – vault March 30, 2022 18:10 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 30, 2022 18:10 Inactive
@ccapurso ccapurso requested a review from swayne275 March 30, 2022 18:10
@ccapurso ccapurso merged commit 55f8f20 into release/1.8.x Mar 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants