Scronkfinkle/quick-secrets

"random" failure (HTTP 500 response)

Closed this issue · 2 comments

eengstrom commented

I've been "randomly" been getting HTTP response code 500 from QS. Happens about 1 out of 10 times creating a secret. I've not noted it when using interactively, but have noted when using the API via curl.

I am gussing that the issue is some hash generation for the secret ID is failing, based upon the logs from running QS in a container. Normally I get this:

10.42.4.0 - - [01/Dec/2021:18:36:05 UTC] "POST /secret HTTP/1.1" 200 35
- -> /secret

When I get the error, I see this:

2021-12-01 18:36:07 - Sequel::DatabaseError - SQLite3::SQLException: unrecognized token: "'�q1x�FBt�Oˮ":
	/var/lib/gems/2.7.0/gems/sqlite3-1.4.2/lib/sqlite3/database.rb:147:in `initialize'
	/var/lib/gems/2.7.0/gems/sqlite3-1.4.2/lib/sqlite3/database.rb:147:in `new'
	/var/lib/gems/2.7.0/gems/sqlite3-1.4.2/lib/sqlite3/database.rb:147:in `prepare'
	/var/lib/gems/2.7.0/gems/sqlite3-1.4.2/lib/sqlite3/database.rb:193:in `execute'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/adapters/sqlite.rb:202:in `block (2 levels) in _execute'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/database/logging.rb:38:in `log_connection_yield'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/adapters/sqlite.rb:202:in `block in _execute'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/connection_pool/threaded.rb:92:in `hold'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/database/connecting.rb:269:in `synchronize'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/adapters/sqlite.rb:193:in `_execute'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/adapters/sqlite.rb:159:in `execute_insert'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/dataset/actions.rb:1109:in `execute_insert'
	/var/lib/gems/2.7.0/gems/sequel-5.50.0/lib/sequel/dataset/actions.rb:401:in `insert'
	/var/lib/gems/2.7.0/gems/quick-secrets-0.0.1/lib/quick-secrets/secret/manager.rb:82:in `store'
	/var/lib/gems/2.7.0/gems/quick-secrets-0.0.1/lib/quick-secrets/web/app.rb:195:in `block (2 levels) in <class:App>'
	/var/lib/gems/2.7.0/gems/quick-secrets-0.0.1/lib/quick-secrets/web/app.rb:32:in `auth_web'
	/var/lib/gems/2.7.0/gems/quick-secrets-0.0.1/lib/quick-secrets/web/app.rb:189:in `block in <class:App>'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1675:in `call'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1675:in `block in compile!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1013:in `block (3 levels) in route!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1032:in `route_eval'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1013:in `block (2 levels) in route!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1061:in `block in process_route'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1059:in `catch'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1059:in `process_route'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1011:in `block in route!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1008:in `each'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1008:in `route!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1129:in `block in dispatch!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1101:in `block in invoke'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1101:in `catch'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1101:in `invoke'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1124:in `dispatch!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:939:in `block in call!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1101:in `block in invoke'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1101:in `catch'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1101:in `invoke'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:939:in `call!'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:929:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/xss_header.rb:18:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/base.rb:50:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/base.rb:50:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/path_traversal.rb:16:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/json_csrf.rb:26:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/base.rb:50:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/base.rb:50:in `call'
	/var/lib/gems/2.7.0/gems/rack-protection-2.1.0/lib/rack/protection/frame_options.rb:31:in `call'
	/var/lib/gems/2.7.0/gems/rack-2.2.3/lib/rack/session/abstract/id.rb:266:in `context'
	/var/lib/gems/2.7.0/gems/rack-2.2.3/lib/rack/session/abstract/id.rb:260:in `call'
	/var/lib/gems/2.7.0/gems/rack-2.2.3/lib/rack/null_logger.rb:11:in `call'
	/var/lib/gems/2.7.0/gems/rack-2.2.3/lib/rack/head.rb:12:in `call'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/show_exceptions.rb:22:in `call'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:216:in `call'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1991:in `call'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1542:in `block in call'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1769:in `synchronize'
	/var/lib/gems/2.7.0/gems/sinatra-2.1.0/lib/sinatra/base.rb:1542:in `call'
	/var/lib/gems/2.7.0/gems/rack-2.2.3/lib/rack/handler/webrick.rb:95:in `service'
	/usr/lib/ruby/2.7.0/webrick/httpserver.rb:140:in `service'
	/usr/lib/ruby/2.7.0/webrick/httpserver.rb:96:in `run'
	/usr/lib/ruby/2.7.0/webrick/server.rb:307:in `block in start_thread'
10.42.2.0 - - [01/Dec/2021:18:36:07 UTC] "POST /secret HTTP/1.1" 500 5269
- -> /secret

Note the odd (UNICODE???) in the token?

Scronkfinkle commented

Yikes. This has to do with storing the data in the database I would imagine. I had a similar issue while developing this, and thought i had fixed it

Scronkfinkle commented

Yeah here it is:

quick-secrets/lib/quick-secrets/secret/manager.rb

Line 82 in 9736ed9

qs_db[:secret].insert(uuid: secret_uuid, initialization_vector: iv, encrypted_data: encrypted, expiration_date: nil)

One of those fields is not being parsed correctly