Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

KEM requests with whitespace in key name fail #135

Closed
tiran opened this issue Mar 22, 2017 · 2 comments
Closed

KEM requests with whitespace in key name fail #135

tiran opened this issue Mar 22, 2017 · 2 comments
Assignees
@raildo
Labels
bug Priority
Milestone
0.3

Comments

@tiran
Copy link
Member

tiran commented Mar 22, 2017 •
edited

The issue was discovered by @MartinBasti in FreeIPA freeipa/freeipa#517 (comment) . @adelton reported the same bug a while ago on bugzilla (can't find it right now).

See PR #134 for a reproducer.

HTTPError: 400 Client Error: Key name kem/key%20with%20space does not match subject kem/key with space for url: http+unix://.%2ftests%2ftmp%2ftest_socket/enc/kem/key%20with%20space
@adelton
Copy link
Contributor

adelton commented Mar 22, 2017

(can't find it right now)

Could it be https://bugzilla.redhat.com/show_bug.cgi?id=1411810?

@tiran
Copy link
Member Author

tiran commented Mar 22, 2017

Simo and I came to an agreement how to fix the issue. Custodia no longer url-decodes the URL keys because we ran into issues with url-encoded slash (/). To fix the problem with white spaces in keys, check_kem_claims should compare url-encoded claim sub with name.

@tiran tiran mentioned this issue Mar 22, 2017
Closed
tiran added a commit to tiran/custodia that referenced this issue Mar 23, 2017
@tiran
Replace path with tuple of unquoted path segments
39d6ba5 
The old path handling code used a string of '/' separated path segments.
This was causing trouble with unquoted of %2F (quoted slash).

A new request parameter 'path_chain' contains a tuple of unquoted path
segments. Since / is no longer used as path separator inside the path,
quoted slash can be safely used.

The old path argument is still available until all plugins have been ported.

Closes: latchset#135
Signed-off-by: Christian Heimes <cheimes@redhat.com>
@tiran tiran mentioned this issue Mar 23, 2017
Merged
tiran added a commit to tiran/custodia that referenced this issue Mar 23, 2017
@tiran
Replace path with tuple of unquoted path segments
8f4127e 
The old path handling code used a string of '/' separated path segments.
This was causing trouble with unquoted of %2F (quoted slash).

A new request parameter 'path_chain' contains a tuple of unquoted path
segments. Since / is no longer used as path separator inside the path,
quoted slash can be safely used.

The old path argument is still available until all plugins have been ported.

Closes: latchset#135
Signed-off-by: Christian Heimes <cheimes@redhat.com>
tiran added a commit to tiran/custodia that referenced this issue Mar 23, 2017
@tiran
Replace path with tuple of unquoted path segments
f467742 
The old path handling code used a string of '/' separated path segments.
This was causing trouble with unquoted of %2F (quoted slash).

A new request parameter 'path_chain' contains a tuple of unquoted path
segments. Since / is no longer used as path separator inside the path,
quoted slash can be safely used.

The old path argument is still available until all plugins have been ported.

Closes: latchset#135
Signed-off-by: Christian Heimes <cheimes@redhat.com>
tiran added a commit that referenced this issue Mar 23, 2017
@tiran
Replace path with tuple of unquoted path segments
7f9ed7b 
The old path handling code used a string of '/' separated path segments.
This was causing trouble with unquoted of %2F (quoted slash).

A new request parameter 'path_chain' contains a tuple of unquoted path
segments. Since / is no longer used as path separator inside the path,
quoted slash can be safely used.

The old path argument is still available until all plugins have been ported.

Closes: #135
Signed-off-by: Christian Heimes <cheimes@redhat.com>
tiran added a commit to tiran/custodia that referenced this issue Mar 28, 2017
@tiran
Replace path with tuple of unquoted path segments
bb70209 
The old path handling code used a string of '/' separated path segments.
This was causing trouble with unquoted of %2F (quoted slash).

A new request parameter 'path_chain' contains a tuple of unquoted path
segments. Since / is no longer used as path separator inside the path,
quoted slash can be safely used.

The old path argument is still available until all plugins have been ported.

Closes: latchset#135
Signed-off-by: Christian Heimes <cheimes@redhat.com>
@tiran tiran added this to the 0.3 milestone Apr 24, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@raildo raildo

Labels
bug Priority
Projects
None yet
Milestone
0.3
Development

No branches or pull requests
3 participants
@tiran @adelton @raildo