Commits on Sep 4, 2023

1. api: encode x-error-msg as JSON - so it does not contain <CR> or <LF> …

   When the server raises an exception in a HTTP request handler context,
   more often than not, the exception is sent back to the client in the
   body.
   
   Additionally, the message of the exception (if any), is also copied as
   is in a x-error-msg HTTP header.
   
   That said, HTTP headers must obey strict rules. The "\r\n" sequence
   indicate the end of the current HTTP header. When using aiohttp, the
   library rejects any header that has a "\r" or "\n" in its value:
   
     ValueError: Newline or carriage return character detected in HTTP status message or header. This is a potential security issue.
   
   As an example, any curtin.util.ProcessExecutionError exception will
   contain "\n" characters when converted into a string.
   
   We now encode the error message as JSON before copying it in the HTTP
   header.
   
   Signed-off-by: Olivier Gayot <[email protected]>

   

   ogayot committed Sep 4, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for b866bd2
   • Browse repository at this point

   Copy the full SHA

   b866bd2 View commit details

   Browse the repository at this point in the history