django encoding issue in password setting

Bug #1894801 reported by Hyeim Yang
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Dashboard (Horizon)
Fix Released
High
Vishal Manchanda

Bug Description

Env: devstack master branch / devstack ussuri/stable branch

Steps to reproduce:

1. Go to admin - Settings - User Settings
2. Change language from English(en) to 한국어(ko) (or Japanese etc.)
3. Go to 'Change Password' panel and change your password

Then, it makes '500 internal server error'.

Error info:
2020-09-08 06:48:02.024858 DEBUG openstack_dashboard.api.keystone Creating a new keystoneclient connection to http://192.168.1.10/identity/v3.
2020-09-08 06:48:02.025560 DEBUG keystoneauth.session REQ: curl -g -i -X GET http://192.168.1.10/identity/v3/users/a6afb486ad9b4200a4ed37b6865f4e65 -H "Accept: application/json" -H "Forwarded: for=61.72.172.1;by=python-keystoneclient" -H "User-Agent: python-keystoneclient" -H "X-Auth-Token: {SHA256}121fbe208e018ce54881718f444281142427350e3e97e2f825ed14670d66b323"
2020-09-08 06:48:02.052111 DEBUG keystoneauth.session RESP: [200] Connection: close Content-Length: 248 Content-Type: application/json Date: Tue, 08 Sep 2020 06:48:02 GMT Server: Apache/2.4.29 (Ubuntu) Vary: X-Auth-Token x-openstack-request-id: req-8bd7b3f9-e47c-4132-ae0a-3334c253fbf2
2020-09-08 06:48:02.052284 DEBUG keystoneauth.session RESP BODY: {"user": {"id": "a6afb486ad9b4200a4ed37b6865f4e65", "name": "admin", "domain_id": "default", "enabled": true, "password_expires_at": null, "options": {}, "links": {"self": "http://192.168.1.10/identity/v3/users/a6afb486ad9b4200a4ed37b6865f4e65"}}}
2020-09-08 06:48:02.052313
2020-09-08 06:48:02.052396 DEBUG keystoneauth.session GET call to identity for http://192.168.1.10/identity/v3/users/a6afb486ad9b4200a4ed37b6865f4e65 used request id req-8bd7b3f9-e47c-4132-ae0a-3334c253fbf2
2020-09-08 06:48:02.052686 DEBUG openstack_dashboard.api.keystone Creating a new keystoneclient connection to http://192.168.1.10/identity/v3.
2020-09-08 06:48:02.132947 mod_wsgi (pid=22999): Exception occurred processing WSGI script '/opt/stack/horizon/openstack_dashboard/wsgi.py'.
2020-09-08 06:48:02.133017 Traceback (most recent call last):
2020-09-08 06:48:02.133033 File "/usr/local/lib/python3.6/dist-packages/django/core/handlers/wsgi.py", line 150, in __call__
2020-09-08 06:48:02.133036 start_response(status, response_headers)
2020-09-08 06:48:02.133046 ValueError: unicode object contains non latin-1 characters

Then, I printed response header and logout_reason includes uninterpretable string.

2020-09-08 07:40:56.926214 [('Content-Type', 'text/html; charset=utf-8'), ('Location', '/dashboard/auth/logout/'), ('X-Frame-Options', 'SAMEORIGIN'), ('Vary', 'Accept-Language, Cookie'), ('Content-Language', 'ko'), ('Content-Length', '0'), ('Set-Cookie', ' logout_reason="\xeb\xb9\x84\xeb\xb0\x80\xeb\xb2\x88\xed\x98\xb8\xeb\xa5\xbc \xeb\xb3\x80\xea\xb2\xbd\xed\x95\x98\xec\x98\x80\xec\x8a\xb5\xeb\x8b\x88\xeb\x8b\xa4. \xeb\x8b\xa4\xec\x8b\x9c \xeb\xa1\x9c\xea\xb7\xb8\xec\x9d\xb8 \xed\x95\xb4\xec\xa3\xbc\xec\x8b\xad\xec\x8b\x9c\xec\x98\xa4."; expires=Tue, 08 Sep 2020 07:41:06 GMT; Max-Age=10; Path=/'), ('Set-Cookie', ' logout_status=success; expires=Tue, 08 Sep 2020 07:41:06 GMT; Max-Age=10; Path=/'), ('Set-Cookie', ' sessionid=fc6dlnkbz9hvv3xp5mrs4gbhtqqhg586; expires=Tue, 08 Sep 2020 08:40:29 GMT; HttpOnly; Max-Age=3573; Path=/; SameSite=Lax')]

I debugged horizon codes and I found problem-causing part.

- 'handle' method in 'horizon/openstack_dashboard/dashboards/settings/password/forms.py'
- 'add_logout_reason' function in 'horizon/horizon/utils/functions.py'

In 'add_logout_reason" function, it translates logout_reason message to Korean and adds translated message into cookie.
I think translated message makes errors.
It works without errors when you don't set a password reason message on the cookie or message doesn't include unicode characters.

Hyeim Yang (melkitan)
description: updated
Revision history for this message
Vishal Manchanda (vishalmanchanda) wrote :

Hi, I am not to reproduce this bug in master branch at-least, now need check in stable/ussuri branch.

Revision history for this message
Vishal Manchanda (vishalmanchanda) wrote :

I am not able to reproduce it even for stable/ussuri.

Changed in horizon:
status: New → Incomplete
Revision history for this message
Akihiro Motoki (amotoki) wrote :

I confirmed this happens when a language is set to Japanese at least.
My environment is DevStack apache deployment of horizon and confirmed both in victoria and master.
Perhaps we need to check more stable branches.

This behavior is really confusing as a user password is successfully changed but no redirection to the login page happens.

Changed in horizon:
status: Incomplete → Confirmed
importance: Undecided → High
tags: added: victoria-backport-potential
Changed in horizon:
assignee: nobody → Vishal Manchanda (vishalmanchanda)
Revision history for this message
Akihiro Motoki (amotoki) wrote :

We cannot pass non-ascii characters directly in cookie values.

A cookie value is a http header value which RFC 7230 Field Value Components [1] specifies:
"Most HTTP header field values are defined using common syntax components (token, quoted-string, and comment) separated by whitespace or specific delimiting characters. Delimiters are chosen from the set of US-ASCII visual characters not allowed in a token (DQUOTE and "(),/:;<=>?@[]{}")."

A solution would be to encode a translated string and decode it before showing it.

[1] https://tools.ietf.org/html/rfc7230#section-3.2.6

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to horizon (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/horizon/+/806949

Changed in horizon:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (master)

Reviewed: https://review.opendev.org/c/openstack/horizon/+/806949
Committed: https://opendev.org/openstack/horizon/commit/e68e23937341d03be7475d71903f31a61403c1e2
Submitter: "Zuul (22348)"
Branch: master

commit e68e23937341d03be7475d71903f31a61403c1e2
Author: Radomir Dopieralski <email address hidden>
Date: Wed Sep 1 18:01:41 2021 +0200

    Escape unicode characters when setting logout_reason cookie

    Change-Id: Ic61a3958461a4a939acc40d1039881e2d4c3a1cd
    Closes-bug: #1894801

Changed in horizon:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to horizon (stable/wallaby)

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/horizon/+/810472

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to horizon (stable/victoria)

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/horizon/+/810473

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/horizon 20.1.0

This issue was fixed in the openstack/horizon 20.1.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (stable/wallaby)

Reviewed: https://review.opendev.org/c/openstack/horizon/+/810472
Committed: https://opendev.org/openstack/horizon/commit/07325eb90ea9bf6c20143678a00f8ccfb1e76f98
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 07325eb90ea9bf6c20143678a00f8ccfb1e76f98
Author: Radomir Dopieralski <email address hidden>
Date: Wed Sep 1 18:01:41 2021 +0200

    Escape unicode characters when setting logout_reason cookie

    Change-Id: Ic61a3958461a4a939acc40d1039881e2d4c3a1cd
    Closes-bug: #1894801
    (cherry picked from commit e68e23937341d03be7475d71903f31a61403c1e2)

tags: added: in-stable-wallaby
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (stable/victoria)

Reviewed: https://review.opendev.org/c/openstack/horizon/+/810473
Committed: https://opendev.org/openstack/horizon/commit/2d7b3e9dc675026208e6cba7ac24066f315268a8
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit 2d7b3e9dc675026208e6cba7ac24066f315268a8
Author: Radomir Dopieralski <email address hidden>
Date: Wed Sep 1 18:01:41 2021 +0200

    Escape unicode characters when setting logout_reason cookie

    Change-Id: Ic61a3958461a4a939acc40d1039881e2d4c3a1cd
    Closes-bug: #1894801
    (cherry picked from commit e68e23937341d03be7475d71903f31a61403c1e2)

tags: added: in-stable-victoria
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/horizon 18.6.3

This issue was fixed in the openstack/horizon 18.6.3 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/horizon 19.3.0

This issue was fixed in the openstack/horizon 19.3.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to horizon (stable/ussuri)

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/horizon/+/850826

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (stable/ussuri)

Reviewed: https://review.opendev.org/c/openstack/horizon/+/850826
Committed: https://opendev.org/openstack/horizon/commit/0116e2bfe66cdd0ca86f809083ab0e21877a78d8
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit 0116e2bfe66cdd0ca86f809083ab0e21877a78d8
Author: Radomir Dopieralski <email address hidden>
Date: Wed Sep 1 18:01:41 2021 +0200

    Escape unicode characters when setting logout_reason cookie

    Conflicts:
            openstack_auth/views.py

    Resolved conflict caused by 6ffeb3cabad7e311a99094b2cf2a2a266be84990,
    which is present stable/victoria and later.

    Change-Id: Ic61a3958461a4a939acc40d1039881e2d4c3a1cd
    Closes-bug: #1894801
    (cherry picked from commit e68e23937341d03be7475d71903f31a61403c1e2)

tags: added: in-stable-ussuri
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/horizon ussuri-eol

This issue was fixed in the openstack/horizon ussuri-eol release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.