influxdata / influxdata/influxdb
Panic on pprof endpoints when authorized is enabled but no user exists
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
1. Install InfluxDB
2. Enable `auth-enabled`, `pprof-enabled` and `pprof-auth-enabled` in configuration
3. Restart InfluxDB
4. Try accessing `/debug/vars` or other pprof endpoint (e.g. `curl http://127.0.0.1:8086/debug/vars`)
__Expected behavior:__
Handler should return `401 Unauthorized`.
__Actual behavior:__
HTTP handler paniced and returned `500 Internal Server Error`.
__Environment info:__
* System info: `Linux 5.4.0-67-generic x86_64`
* InfluxDB version: `InfluxDB v1.8.4 (git: 1.8 bc8ec4384eed25436d31045f974bf39f3310fa3c)`
* Other relevant environment details: None
__Relevant Config:__
```
[http]
enabled = true
auth-enabled = true
pprof-enabled = true
pprof-auth-enabled = true
```
__Logs:__
```
Mar 18 13:47:30 influx01 influxd[2638]: [httpd] 127.0.0.1 - - [18/Mar/2021:13:47:30 +0000] "GET /debug/vars HTTP/1.1" 200 0 "-" "curl/7.68.0" 7b99ef33-87f0-11eb-b68f-faee0baa9854 32 [panic:runtime error: invalid memory address or nil pointer dereference] goroutine 31587 [running]:
Mar 18 13:47:30 influx01 influxd[2638]: runtime/debug.Stack(0xc00012e120, 0xc0001ee400, 0xc00cf45c831777ba)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/runtime/debug/stack.go:24 +0x9d
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).recovery.func1.1(0xc00012e120, 0xc0001ee400, 0xc00cf45c831777ba, 0x5f43dd4e40ee, 0x35f5860, 0xc0004aa300, 0x2584ca0, 0xc000214380)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1979 +0xc7
Mar 18 13:47:30 influx01 influxd[2638]: panic(0x144e700, 0x31ca820)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/runtime/panic.go:679 +0x1b2
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.NewHandler.func3.1(0x7fd0a80a55f8, 0xc00012e140, 0xc0001ee400, 0x0, 0x0)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:238 +0x5d
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.authenticate.func1(0x7fd0a80a55f8, 0xc00012e140, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1841 +0x94
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccee0, 0x7fd0a80a55f8, 0xc00012e140, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).responseWriter.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1956 +0xab
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf00, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.gzipFilter.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/gzip.go:23 +0x2ff
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf20, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf40, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.cors.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1880 +0xde
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf60, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.requestID.func1(0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1911 +0x34d
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccf80, 0x257cc20, 0xc00012e120, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).recovery.func1(0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:1993 +0x17b
Mar 18 13:47:30 influx01 influxd[2638]: net/http.HandlerFunc.ServeHTTP(0xc0004ccfa0, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2007 +0x44
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/vendor/github.com/bmizerany/pat.(*PatternServeMux).ServeHTTP(0xc000499d40, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/vendor/github.com/bmizerany/pat/mux.go:117 +0x153
Mar 18 13:47:30 influx01 influxd[2638]: github.com/influxdata/influxdb/services/httpd.(*Handler).ServeHTTP(0xc0004aa300, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/go/src/github.com/influxdata/influxdb/services/httpd/handler.go:451 +0x4d2
Mar 18 13:47:30 influx01 influxd[2638]: net/http.serverHandler.ServeHTTP(0xc0000f60e0, 0x2584ca0, 0xc000214380, 0xc0001ee400)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2802 +0xa4
Mar 18 13:47:30 influx01 influxd[2638]: net/http.(*conn).serve(0xc00015ebe0, 0x258ca20, 0xc000c7eb40)
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:1890 +0x875
Mar 18 13:47:30 influx01 influxd[2638]: created by net/http.(*Server).Serve
Mar 18 13:47:30 influx01 influxd[2638]: #011/usr/local/go/src/net/http/server.go:2928 +0x384
```
Contributor guide
Research direction
Start in services/httpd/handler.go, especially the authentication path around lines 238 and 1841 shown in the stack trace. Reproduce the issue with the listed configuration and curl request to /debug/vars; done means pprof endpoints return 401 Unauthorized rather than panicking with a 500 response when no user exists.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100