Implement ws-protocol's `fetchAsset` specification #232

achim-k · 2023-06-14T13:58:05Z

Public-Facing Changes

Implements Extend spec to allow fetching of assets ws-protocol#462 to allow fetching of assets

Description

Implements the above mentioned spec to fetch assets which will allow Foxglove Studio to request assets (such as URDF mesh files) over the websocket connection.

ros2_foxglove_bridge/src/ros2_foxglove_bridge.cpp

jtbandes · 2023-07-06T02:50:31Z

README.md

@@ -76,7 +76,8 @@ Parameters are provided to configure the behavior of the bridge. These parameter
  * __client_topic_whitelist__: List of regular expressions ([ECMAScript grammar](https://en.cppreference.com/w/cpp/regex/ecmascript)) of whitelisted client-published topic names. Defaults to `[".*"]`.
 * __send_buffer_limit__: Connection send buffer limit in bytes. Messages will be dropped when a connection's send buffer reaches this limit to avoid a queue of outdated messages building up. Defaults to `10000000` (10 MB).
 * __use_compression__: Use websocket compression (permessage-deflate). Suited for connections with smaller bandwith, at the cost of additional CPU load.
- * __capabilities__: List of supported [server capabilities](https://github.com/foxglove/ws-protocol/blob/main/docs/spec.md). Defaults to `[clientPublish,parameters,parametersSubscribe,services,connectionGraph]`.
+ * __capabilities__: List of supported [server capabilities](https://github.com/foxglove/ws-protocol/blob/main/docs/spec.md). Defaults to `[clientPublish,parameters,parametersSubscribe,services,connectionGraph,assets]`.
+ * __asset_uri_whitelist__: List of regular expressions ([ECMAScript grammar](https://en.cppreference.com/w/cpp/regex/ecmascript)) of allowed asset URIs. Defaults to `["package://.*"]`.


How does a user know what patterns would be valuable to put in here? There is no documentation explaining how file:// urls work.

allowlist?

https://inclusivenaming.org/word-lists/tier-1/whitelist/

It uses resource_retriever under the hood which is able to resolve package:// URLs but also file:// and http(s)://. Will extend the documentation

jtbandes · 2023-07-06T02:52:12Z

ros1_foxglove_bridge/src/ros1_foxglove_bridge_nodelet.cpp

+        throw std::runtime_error("Asset URI not allowed: " + uri);
+      }
+
+      const resource_retriever::MemoryResource memoryResource = _resource_retriever.get(uri);


Is there any way to limit the ability to access local files within a certain directory? It seems like a big security hole if this can access any file on the local machine.

Is there any way to limit the ability to access local files within a certain directory? It seems like a big security hole if this can access any file on the local machine.

Agreed, that's why I added the allowlist parameter. If you only want to specify certain package folders, you would have to list them manually. file:// URIs are by default not allowed.

Example

['package://robot_description/.+'] - allow only access to robot_description package folder

['package://.+[.]dae$','package://.+[.]stl$'] - only allow fetching of dae & stl files from package folders

Maybe the default ['package://.*'] is too permissive. Should I change it to only allow urdf, dae & stl files?

Bummer: with the default ['package://.*'] one can specify relative paths to retrieve files that are not intended to be fetched as assets:

"uri": "package://ur_description/../../../secret.txt"

Yep .. is what I was thinking of.
If there is some upstream infrastructure we depend on then maybe there's not a lot we can do about this, but we should at least provide people with a warning in documentation before they enable this feature.

If there is some upstream infrastructure we depend on then maybe there's not a lot we can do about this, but we should at least provide people with a warning in documentation before they enable this feature.

The default regex is now a lot stricter. Do you think that's sufficient or should we the asset feature by default?

jtbandes · 2023-07-10T18:27:03Z

foxglove_bridge_base/include/foxglove_bridge/common.hpp

@@ -145,4 +147,16 @@ struct ServiceResponse {

 using ServiceRequest = ServiceResponse;

+enum FetchAssetStatus {


Prefer enum class to avoid polluting the namespace

Add : uint8_t to match the spec

jtbandes · 2023-07-10T18:29:02Z

foxglove_bridge_base/include/foxglove_bridge/websocket_server.hpp

+      const auto uri = payload.at("uri").get<std::string>();
+      const auto requestId = payload.at("requestId").get<uint32_t>();


what happens if these are missing or the wrong type? if an exception is thrown here, will it be caught somewhere?

Yes, any exception that is not handled in the operation handler would be caught here:

ros-foxglove-bridge/foxglove_bridge_base/include/foxglove_bridge/websocket_server.hpp

Lines 560 to 571 in 9a206a0

case OpCode::TEXT: {

_handlerCallbackQueue->addCallback([this, hdl, msg]() {

try {

handleTextMessage(hdl, msg);

} catch (const std::exception& e) {

sendStatusAndLogMsg(hdl, StatusLevel::Error, e.what());

} catch (...) {

sendStatusAndLogMsg(hdl, StatusLevel::Error,

"Exception occurred when executing text message handler");

}

});

} break;

jtbandes · 2023-07-10T18:30:04Z

foxglove_bridge_base/include/foxglove_bridge/websocket_server.hpp

+    return;
+  }
+
+  const size_t dataSize = response.status == FetchAssetStatus::Success ? response.data.size() : 0ul;


do we need to similarly check if status==Error before adding errorMessage.size() to the messageSize?

jtbandes · 2023-07-10T18:32:53Z

foxglove_bridge_base/src/test/test_client.cpp

+}
+
+std::future<FetchAssetResponse> waitForFetchAssetResponse(std::shared_ptr<ClientInterface> client) {
+  auto promise = std::make_shared<std::promise<FetchAssetResponse>>();


nit: is make_shared required?

You left a similar comment here: #239 (comment)

Will create an issue to keep track of this

jtbandes · 2023-07-10T18:33:12Z

foxglove_bridge_base/src/test/test_client.cpp

+      const auto payloadLength = dataLength - offset;
+      response.data.resize(payloadLength);
+      std::memcpy(response.data.data(), data + offset, payloadLength);
+      promise->set_value(response);


nit: maybe std::move(response)?

jtbandes · 2023-07-10T18:36:32Z

ros2_foxglove_bridge/src/ros2_foxglove_bridge.cpp

+      throw std::runtime_error("Asset URI not allowed: " + uri);
+    }
+
+    const resource_retriever::MemoryResource memoryResource = _resource_retriever.get(uri);


so this will block, even for HTTP fetches? Is there any built-in way to do this in a non-blocking fashion or should we consider doing it in a thread (if the API is thread safe)?

You are right, this will block and prevent any other client operation from being handled since we use only a single thread for handling client requests. I guess that this wouldn't be much of a problem for file:// or package:// URIs as these will succeed/fail fairly quickly, but for http it might indeed be problematic. I will see what I can do

jtbandes · 2023-07-10T23:31:15Z

ros2_foxglove_bridge/src/ros2_foxglove_bridge.cpp

@@ -846,7 +856,9 @@ void FoxgloveBridge::fetchAsset(const std::string& uri, uint32_t requestId,
    response.errorMessage = "Failed to retrieve asset " + uri;
  }

-  _server->sendFetchAssetResponse(clientHandle, response);
+  if (_server) {
+    _server->sendFetchAssetResponse(clientHandle, response);


Is this method thread safe?

Yes. It's basically the same as _server->sendMessage which is also called by multiple threads (if subscribed to multiple topics)

### Public-Facing Changes Avoid usage of tmpnam() for creating random filename ### Description Follow up of #232. ROS build farm complained about usage of `tmpnam`. This PR replaces it by using the epoch time in milliseconds to create a somewhat random filename (used for tests only) https://build.ros2.org/job/Idev__foxglove_bridge__ubuntu_jammy_amd64/9/

achim-k commented Jun 16, 2023

View reviewed changes

ros2_foxglove_bridge/src/ros2_foxglove_bridge.cpp Outdated Show resolved Hide resolved

achim-k force-pushed the achim/fg-3777-asset-fetching branch 3 times, most recently from 1a04c50 to d5150d5 Compare June 30, 2023 17:00

jtbandes reviewed Jul 6, 2023

View reviewed changes

achim-k added 3 commits July 6, 2023 18:52

Implement fetchAsset spec

8c02db3

Stricter asset uri whitelist

903579e

asset_uri_whitelist -> asset_uri_allowlist

38efea3

achim-k force-pushed the achim/fg-3777-asset-fetching branch from d5150d5 to 38efea3 Compare July 6, 2023 21:23

achim-k added 2 commits July 7, 2023 14:00

Reject URIs containing two consecutive dots, add security notes

849a104

more whitelist -> allowlist

9a206a0

achim-k force-pushed the achim/fg-3777-asset-fetching branch from dbfd384 to 9a206a0 Compare July 7, 2023 14:17

achim-k requested a review from jtbandes July 10, 2023 14:37

jtbandes approved these changes Jul 10, 2023

View reviewed changes

achim-k mentioned this pull request Jul 10, 2023

Improve testing code #245

Open

achim-k added 5 commits July 10, 2023 20:01

address comments

ad437ba

Fetch assets in a separate thread

16cba13

Set ASIO_STANDALONE in cmake

33e8549

fixup set asio_standalone in cmake

f0efd85

fixup set asio_standalone in cmake

aa6ca52

achim-k merged commit 0d712f9 into main Jul 10, 2023
8 checks passed

achim-k deleted the achim/fg-3777-asset-fetching branch July 10, 2023 22:07

jtbandes reviewed Jul 10, 2023

View reviewed changes

achim-k mentioned this pull request Jul 11, 2023

Avoid usage of tmpnam() for creating random filename #246

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement ws-protocol's `fetchAsset` specification #232

Implement ws-protocol's `fetchAsset` specification #232

achim-k commented Jun 14, 2023 •

edited

Loading

jtbandes Jul 6, 2023

jtbandes Jul 6, 2023

achim-k Jul 6, 2023

jtbandes Jul 6, 2023

achim-k Jul 6, 2023

achim-k Jul 6, 2023

jtbandes Jul 6, 2023 •

edited

Loading

achim-k Jul 6, 2023

jtbandes Jul 10, 2023

jtbandes Jul 10, 2023

achim-k Jul 10, 2023

jtbandes Jul 10, 2023

jtbandes Jul 10, 2023

achim-k Jul 10, 2023

jtbandes Jul 10, 2023

jtbandes Jul 10, 2023

achim-k Jul 10, 2023

jtbandes Jul 10, 2023

achim-k Jul 11, 2023

		@@ -145,4 +147,16 @@ struct ServiceResponse {

		using ServiceRequest = ServiceResponse;

		enum FetchAssetStatus {

		const auto uri = payload.at("uri").get<std::string>();
		const auto requestId = payload.at("requestId").get<uint32_t>();

	case OpCode::TEXT: {
	_handlerCallbackQueue->addCallback([this, hdl, msg]() {
	try {
	handleTextMessage(hdl, msg);
	} catch (const std::exception& e) {
	sendStatusAndLogMsg(hdl, StatusLevel::Error, e.what());
	} catch (...) {
	sendStatusAndLogMsg(hdl, StatusLevel::Error,
	"Exception occurred when executing text message handler");
	}
	});
	} break;

Implement ws-protocol's fetchAsset specification #232

Implement ws-protocol's fetchAsset specification #232

Conversation

achim-k commented Jun 14, 2023 • edited Loading

Public-Facing Changes

Description

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jtbandes Jul 6, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Implement ws-protocol's `fetchAsset` specification #232

Implement ws-protocol's `fetchAsset` specification #232

achim-k commented Jun 14, 2023 •

edited

Loading

jtbandes Jul 6, 2023 •

edited

Loading