x-error-msg HTTP header sometimes contains newlines which make it invalid

Bug #2039075 reported by Olivier Gayot
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
subiquity
Fix Released
Undecided
Olivier Gayot

Bug Description

When the Subiquity server raises an exception in a HTTP request handler context, more often than not, the exception is sent back to the client in the body.

Additionally, the message of the exception (if any), is also copied as is in a x-error-msg HTTP header.

That said, HTTP headers must obey strict rules. While "\n" indicates the end of the current HTTP header, the aiohttp library rejects any header that has a "\r" or "\n" in its value:

ValueError: Newline or carriage return character detected in HTTP status message or header. This is a potential security issue.

As an example, any curtin.util.ProcessExecutionError exception will contain "\n" characters when converted into a string.

Revision history for this message
Olivier Gayot (ogayot) wrote :
Changed in subiquity:
status: New → Fix Committed
assignee: nobody → Olivier Gayot (ogayot)
Olivier Gayot (ogayot)
Changed in subiquity:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.