Bug #22617: Stackoverflow if {} used in place of [] for properties in node create api - Rudder - Issue Tracker

Actions

Copy link

Bug #22617

closed

Stackoverflow if {} used in place of [] for properties in node create api

Added by François ARMAND about 1 year ago. Updated 9 months ago.

Status:

Released

Priority:

N/A

Assignee:

Vincent MEMBRÉ

Category:

Security

Target version:

7.2.6

Pull Request:

https://github.com/Normation/rudder/p...

Severity:

Critical - prevents main use of Rudder | no workaround | data loss | security

UX impact:

I hate Rudder for that

User visibility:

Operational - other Techniques | Rudder settings | Plugins

Effort required:

Priority:

117

Name check:

To do

Fix check:

Checked

Regression:

Description

If you use a json object in place of a json array for properties in node create API, it leads to a stackoverflow and a crash of rudder.

Example:

curl -k  -H "X-API-Token: xxxxxxxx" -H "Content-Type: application/json" -X PUT 'https://xxxx/rudder/api/latest/nodes' -d "@node1.json"

[
        {
          "id": "888880d3-c0a9-4874-8485-478e7e92d777" 
        , "hostname": "test.rudder.local" 
        , "status"  : "pending" 
        , "os": {
            "type": "linux" 
           , "name": "debian" 
           , "version": "9.5" 
           , "fullName": "Debian GNU/Linux 9 (stretch)" 
           }
        , "policyServerId": "root" 
        , "machineType": "vmware" 
        , "agentKey" : {
            "value" : "----BEGIN CERTIFICATE---- ...." 
          }
        , "properties": {
            { "name":"tags", "value": ["some", "tags"]}
          }
        , "ipAddresses": ["192.168.180.90", "127.0.0.1"]
        }
]

Notice the "properties": { in place of "properties": [

Log:

java.lang.StackOverflowError
    at scala.collection.mutable.ListBuffer$$Lambda$7319/0x00000007c1f7cc40.<init>(Unknown Source)
    at scala.collection.mutable.ListBuffer$$Lambda$7319/0x00000007c1f7cc40.get$Lambda(Unknown Source)
    at scala.collection.mutable.ListBuffer.iterator(ListBuffer.scala:55)
    at scala.collection.IterableOnceOps.addString(IterableOnce.scala:1219)
    at scala.collection.IterableOnceOps.addString$(IterableOnce.scala:1216)
    at scala.collection.AbstractIterable.addString(Iterable.scala:933)
    at scala.collection.IterableOnceOps.mkString(IterableOnce.scala:1166)
    at scala.collection.IterableOnceOps.mkString$(IterableOnce.scala:1164)
    at scala.collection.AbstractIterable.mkString(Iterable.scala:933)
    at scala.collection.Iterable.toString(Iterable.scala:78)
    at scala.collection.Iterable.toString$(Iterable.scala:78)
    at scala.collection.Seq.toString(Seq.scala:43)
    at scala.collection.Seq.toString$(Seq.scala:43)
    at scala.collection.AbstractSeq.toString(Seq.scala:1188)
    at java.base/java.lang.String.valueOf(String.java:2951)
    at java.base/java.lang.StringBuilder.append(StringBuilder.java:172)
    at scala.collection.IterableOnceOps.addString(IterableOnce.scala:1221)
    at scala.collection.IterableOnceOps.addString$(IterableOnce.scala:1216)
    at scala.collection.AbstractIterator.addString(Iterator.scala:1300)
    at scala.collection.IterableOnceOps.mkString(IterableOnce.scala:1166)
    at scala.collection.IterableOnceOps.mkString$(IterableOnce.scala:1164)
    at scala.collection.AbstractIterator.mkString(Iterator.scala:1300)
    at scala.runtime.ScalaRunTime$._toString(ScalaRunTime.scala:156)
    at net.liftweb.json.JsonParser$IntermediateJObject.toString(JsonParser.scala:179)
    at java.base/java.lang.String.valueOf(String.java:2951)
    at java.base/java.lang.StringBuilder.append(StringBuilder.java:172)
    at scala.collection.IterableOnceOps.addString(IterableOnce.scala:1221)
    at scala.collection.IterableOnceOps.addString$(IterableOnce.scala:1216)
    at scala.collection.AbstractIterable.addString(Iterable.scala:933)
    at scala.collection.IterableOnceOps.mkString(IterableOnce.scala:1166)
    at scala.collection.IterableOnceOps.mkString$(IterableOnce.scala:1164)
    at scala.collection.AbstractIterable.mkString(Iterable.scala:933)
    at scala.collection.Iterable.toString(Iterable.scala:78)
    at scala.collection.Iterable.toString$(Iterable.scala:78)
    at scala.collection.Seq.toString(Seq.scala:43)
    at scala.collection.Seq.toString$(Seq.scala:43)
    at scala.collection.AbstractSeq.toString(Seq.scala:1188)
    at java.base/java.lang.String.valueOf(String.java:2951)
    at java.base/java.lang.StringBuilder.append(StringBuilder.java:172)
    at scala.collection.IterableOnceOps.addString(IterableOnce.scala:1221)
    at scala.collection.IterableOnceOps.addString$(IterableOnce.scala:1216)
    at scala.collection.AbstractIterator.addString(Iterator.scala:1300)
    at scala.collection.IterableOnceOps.mkString(IterableOnce.scala:1166)
    at scala.collection.IterableOnceOps.mkString$(IterableOnce.scala:1164)
    at scala.collection.AbstractIterator.mkString(Iterator.scala:1300)
    at scala.runtime.ScalaRunTime$._toString(ScalaRunTime.scala:156)
    at net.liftweb.json.JsonParser$IntermediateJObject.toString(JsonParser.scala:179)
    at java.base/java.lang.String.valueOf(String.java:2951)
    at java.base/java.lang.StringBuilder.append(StringBuilder.java:172)
...