Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] ApiCaller accept invalid http method which cause dashboard crash #800

Closed
Hailong-am opened this issue Jun 30, 2023 · 0 comments
Closed
Assignees
Labels
2.9.0 bug Something isn't working

Comments

@Hailong-am
Copy link
Collaborator

What is the bug?
ApiCaller don't do validation on http method. when we pass an invalid http method in request body that cause dashboard server crash

How can one reproduce the bug?

  1. start dashboard server
  2. run below command
curl 'http://localhost:5601/api/ism/apiCaller' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Authorization: Basic YWRtaW46YWRtaW4=' \
  -H 'Content-Type: application/json' \
  -H 'osd-version: 3.0.0' \
  -H 'osd-xsrf: osd-fetch' \
  --data-raw '{"data":{"method":"a invalid http method here","path":"/_plugins/_im/lron/LRON%3Aindices%3Adata%2Fwrite%2Freindex","body":{"lron_config":{"action_name":"indices:data/write/reindex","channels":[{"id":"cAkHvYgB0GBNl905IY7P"}],"lron_condition":{"failure":true,"success":true}}}},"endpoint":"transport.request"}'
  1. dashboard crash
TypeError: Method must be a valid HTTP token ["a invalid http method here"]
    at new NodeError (node:internal/errors:387:5)
    at new ClientRequest (node:_http_client:215:13)
    at Object.request (node:https:357:10)
    at HttpConnector.request (/Users/ihailong/code/OpenSearch-Dashboards/node_modules/elasticsearch/src/lib/connectors/http.js:182:23)
    at sendReqWithConnection (/Users/ihailong/code/OpenSearch-Dashboards/node_modules/elasticsearch/src/lib/transport.js:263:35)
    at Object.utils.applyArgs (/Users/ihailong/code/OpenSearch-Dashboards/node_modules/elasticsearch/src/lib/utils.js:188:19)
    at wrapper (/Users/ihailong/code/OpenSearch-Dashboards/node_modules/lodash/lodash.js:5255:19)
    at processTicksAndRejections (node:internal/process/task_queues:78:11)
 server crashed  with status code 1

What is the expected behavior?
A clear and concise description of what you expected to happen.

What is your host/environment?

  • OS: [e.g. iOS]
  • Version [e.g. 22]
  • Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
Add any other context about the problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.9.0 bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants