Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Connection error messages are unsafe: wrap them #37329

Merged
merged 2 commits into from Mar 13, 2018
Merged

Connection error messages are unsafe: wrap them #37329

merged 2 commits into from Mar 13, 2018

Conversation

pilou-
Copy link
Contributor

@pilou- pilou- commented Mar 13, 2018

SUMMARY

Connection error messages are unsafe: wrap them.

For example, in case of error, docker connection plugin returns exception message containing Go template ({{.Server.Version}}). These messages weren't tagged as unsafe and were consequently rendered, then a template exception occurred.

The conditional check 'result is failed' failed. The error was:
{
  'msg': u'Docker version check ([\'/usr/bin/docker\', \'version\', \'--format\', "\'{{.Server.Version}}\'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied\n',
  'failed': True
}:
template error while templating string: unexpected '.'.
String: Docker version check (['/usr/bin/docker', 'version', '--format', "'{{.Server.Version}}'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied

Integration test provided 馃帀

ISSUE TYPE
  • Bugfix Pull Request
COMPONENT NAME

connection plugin

ANSIBLE VERSION
ansible 2.6.0 (devel c1008d693c) last updated 2018/03/12 18:09:57 (GMT +200)
ADDITIONAL INFORMATION

2.4 and 2.5 are affected too: bugfix should be backported.

@ansibot ansibot added bug This issue/PR relates to a bug. needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR. needs_triage Needs a first human triage before being processed. support:community This issue/PR relates to code supported by the Ansible community. support:core This issue/PR relates to code supported by the Ansible Engineering Team. test This PR relates to tests. labels Mar 13, 2018
@bcoca bcoca removed the needs_triage Needs a first human triage before being processed. label Mar 13, 2018
@bcoca bcoca requested review from abadger and jimi-c March 13, 2018 03:16
@pilou-
Copy link
Contributor Author

pilou- commented Mar 13, 2018 •
edited

CI fail with both FreeBSD environments:

2018-03-13 02:44:12 Running connection integration test script
2018-03-13 02:44:12 Run command: ./runme.sh -v
2018-03-13 02:44:12 NOTICE: To resume at this test target, use the option: --start-at connection
2018-03-13 02:44:12 NOTICE: To resume after this test target, use the option: --start-at copy
2018-03-13 02:44:12 ERROR: Required program "./runme.sh" not found.

@mattclay is there something special with runme.sh and FreeBSD environments ?

Edited: shebang was incorrect #!/usr/bin/env bash must be used ! Thanks to mscherer for pointing that !

@pilou-
Check that connection error msg are not unsafe
e556340
@pilou-
Connection error messages are unsafe: wrap them
d2d0cf2 
For example, in case of error, docker connection plugin returns exception
message containing Go template. These messages weren't tagged as unsafe
and were consequently rendered:

The conditional check 'result is failed' failed. The error was:
{
  'msg': u'Docker version check ([\'/usr/bin/docker\', \'version\', \'--format\', "\'{{.Server.Version}}\'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied\n',
  'failed': True
}:
template error while templating string: unexpected '.'.
String: Docker version check (['/usr/bin/docker', 'version', '--format', "'{{.Server.Version}}'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied
@pilou- pilou- force-pushed the connection_avoid_to_return_unsafe_data branch from cf040f3 to d2d0cf2 Compare March 13, 2018 19:55
@ansibot ansibot removed the needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR. label Mar 13, 2018
@abadger
Copy link
Contributor

abadger commented Mar 13, 2018

This looks right to me. Merging.

@abadger abadger merged commit 4378542 into ansible:devel Mar 13, 2018
abadger pushed a commit that referenced this pull request Mar 14, 2018
@pilou- @abadger
Connection error messages are unsafe: wrap them (#37329)
1480d5b 
* Check that connection error msg are not unsafe

* Connection error messages are unsafe: wrap them

For example, in case of error, docker connection plugin returns exception
message containing Go template. These messages weren't tagged as unsafe
and were consequently rendered:

The conditional check 'result is failed' failed. The error was:
{
  'msg': u'Docker version check ([\'/usr/bin/docker\', \'version\', \'--format\', "\'{{.Server.Version}}\'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied\n',
  'failed': True
}:
template error while templating string: unexpected '.'.
String: Docker version check (['/usr/bin/docker', 'version', '--format', "'{{.Server.Version}}'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied

(cherry picked from commit 4378542)
abadger pushed a commit to abadger/ansible that referenced this pull request Mar 14, 2018
@pilou- @abadger
Connection error messages are unsafe: wrap them (ansible#37329)
106487e 
* Check that connection error msg are not unsafe

* Connection error messages are unsafe: wrap them

For example, in case of error, docker connection plugin returns exception
message containing Go template. These messages weren't tagged as unsafe
and were consequently rendered:

The conditional check 'result is failed' failed. The error was:
{
  'msg': u'Docker version check ([\'/usr/bin/docker\', \'version\', \'--format\', "\'{{.Server.Version}}\'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied\n',
  'failed': True
}:
template error while templating string: unexpected '.'.
String: Docker version check (['/usr/bin/docker', 'version', '--format', "'{{.Server.Version}}'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied

(cherry picked from commit 4378542)
nitzmahone pushed a commit that referenced this pull request Mar 15, 2018
@abadger @nitzmahone
Bkprt conn err msg no template (#37381)
c264061 
*  Connection error messages are unsafe: wrap them (#37329)

* Check that connection error msg are not unsafe

* Connection error messages are unsafe: wrap them

For example, in case of error, docker connection plugin returns exception
message containing Go template. These messages weren't tagged as unsafe
and were consequently rendered:

The conditional check 'result is failed' failed. The error was:
{
  'msg': u'Docker version check ([\'/usr/bin/docker\', \'version\', \'--format\', "\'{{.Server.Version}}\'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied\n',
  'failed': True
}:
template error while templating string: unexpected '.'.
String: Docker version check (['/usr/bin/docker', 'version', '--format', "'{{.Server.Version}}'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied

(cherry picked from commit 4378542)

* Add a changelog for the no-template error message fix
abadger pushed a commit that referenced this pull request Mar 19, 2018
@pilou- @abadger
Connection error messages are unsafe: wrap them (#37329)
4f071bd 
* Check that connection error msg are not unsafe

* Connection error messages are unsafe: wrap them

For example, in case of error, docker connection plugin returns exception
message containing Go template. These messages weren't tagged as unsafe
and were consequently rendered:

The conditional check 'result is failed' failed. The error was:
{
  'msg': u'Docker version check ([\'/usr/bin/docker\', \'version\', \'--format\', "\'{{.Server.Version}}\'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied\n',
  'failed': True
}:
template error while templating string: unexpected '.'.
String: Docker version check (['/usr/bin/docker', 'version', '--format', "'{{.Server.Version}}'"]) failed: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/version: dial unix /var/run/docker.sock: connect: permission denied

(cherry picked from commit 4378542)
@ansible ansible locked and limited conversation to collaborators Apr 27, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@abadger abadger Awaiting requested review from abadger

@jimi-c jimi-c Awaiting requested review from jimi-c

Assignees
No one assigned
Labels
bug This issue/PR relates to a bug. support:community This issue/PR relates to code supported by the Ansible community. support:core This issue/PR relates to code supported by the Ansible Engineering Team. test This PR relates to tests.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@pilou- @abadger @bcoca @ansibot