influxdata / influxdata/influxdb

Panic on pprof endpoints when authorized is enabled but no user exists

Open
#20,998 0 comments 0 reactions 0 assignees View on GitHub
1.x panic
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
1. Install InfluxDB
2. Enable `auth-enabled`, `pprof-enabled` and `pprof-auth-enabled` in configuration
3. Restart InfluxDB
4. Try accessing `/debug/vars` or other pprof endpoint (e.g. `curl http://127.0.0.1:8086/debug/vars`)

__Expected behavior:__
Handler should return `401 Unauthorized`.

__Actual behavior:__
HTTP handler paniced and returned `500 Internal Server Error`.

__Environment info:__
* System info: `Linux 5.4.0-67-generic x86_64`
* InfluxDB version: `InfluxDB v1.8.4 (git: 1.8 bc8ec4384eed25436d31045f974bf39f3310fa3c)`
* Other relevant environment details: None

__Relevant Config:__
```
[http]
enabled = true
auth-enabled = true
pprof-enabled = true
pprof-auth-enabled = true
```

__Logs:__
```
Mar 18 13:47:30 influx01 influxd[2638]: [httpd] 127.0.0.1 - - [18/Mar/2021:13:47:30 +0000] "GET /debug/vars HTTP/1.1" 200 0 "-" "curl/7.68.0" 7b99ef33-87f0-11eb-b68f-faee0baa9854 32 [panic:runtime error: invalid memory address or nil pointer dereference] goroutine 31587 [running]:
Mar 18 13:47:30 influx01 influxd[2638]: runtime/debug.Stack(0xc00012e120, 0xc0001ee400, 0xc00cf45c831777ba)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/runtime/debug/stack.go:24 +0x9d
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).recovery.func1.1(0xc00012e120, 0xc0001ee400, 0xc00cf45c831777ba, 0x5f43dd4e40ee, 0x35f5860, 0xc0004aa300, 0x2584ca0, 0xc000214380)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1979 +0xc7
Mar 18 13:47:30 influx01 influxd[2638]: panic(0x144e700, 0x31ca820)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/runtime/panic.go:679 +0x1b2
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.NewHandler.func3.1(0x7fd0a80a55f8, 0xc00012e140, 0xc0001ee400, 0x0, 0x0)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:238 +0x5d
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.authenticate.func1(0x7fd0a80a55f8, 0xc00012e140, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1841 +0x94
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccee0, 0x7fd0a80a55f8, 0xc00012e140, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).responseWriter.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1956 +0xab
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf00, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.gzipFilter.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/gzip.go:23 +0x2ff
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf20, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf40, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.cors.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1880 +0xde
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf60, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.requestID.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1911 +0x34d
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf80, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).recovery.func1(0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1993 +0x17b
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccfa0, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/vendor/github.com/bmizerany/pat.(*PatternServeMux).ServeHTTP(0xc000499d40, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/vendor/github.com/bmizerany/pat/mux.go:117 +0x153
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).ServeHTTP(0xc0004aa300, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:451 +0x4d2
Mar 18 13:47:30 influx01 influxd[2638]: net/http.serverHandler.ServeHTTP(0xc0000f60e0, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2802 +0xa4
Mar 18 13:47:30 influx01 influxd[2638]: net/http.(*conn).serve(0xc00015ebe0, 0x258ca20, 0xc000c7eb40)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:1890 +0x875
Mar 18 13:47:30 influx01 influxd[2638]: created by net/http.(*Server).Serve
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2928 +0x384
```

Contributor guide

Open the contributing guide

Research direction

Start in services/httpd/handler.go, especially the authentication path around lines 238 and 1841 shown in the stack trace. Reproduce the issue with the listed configuration and curl request to /debug/vars; done means pprof endpoints return 401 Unauthorized rather than panicking with a 500 response when no user exists.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.