1075030 - [traceback] fuzzing throws RequiredParameterError: signature error

Status: VERIFIED FIXED

(Socorro Graveyard :: Middleware, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

I just fuzzed Socorro staging, and found this:

https://crash-stats.allizom.org/signature_summary/json_data?%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker%280x00109E%29%3C/scRipt%3E throws:

RequiredParameterError: signature

Stacktrace (most recent call last):

  File "django/core/handlers/base.py", line 113, in get_response
    response = callback(request, *callback_args, **callback_kwargs)
  File "crashstats/crashstats/utils.py", line 53, in wrapper
    response = f(request, *args, **kw)
  File "crashstats/crashstats/views.py", line 2154, in signature_summary
    versions=version,
  File "crashstats/crashstats/models.py", line 313, in get
    return self._get(expect_json=expect_json, **kwargs)
  File "crashstats/crashstats/models.py", line 364, in _get
    params = self.kwargs_to_params(kwargs)
  File "crashstats/crashstats/models.py", line 408, in kwargs_to_params
    raise RequiredParameterError(name)

Errormill: https://errormill.mozilla.org/webtools/socorro-stage/group/172855/

Comment 1

[Robert Helmer [:rhelmer]]

I don't think fuzzing is related here, it's raising an exception because required parameters are missing, you can make it happen by passing no parameters at all:

https://crash-stats.allizom.org/signature_summary/json_data

We should return a nicer error message instead of 500ing.

Comment 2

[Peter Bengtsson [:peterbe]]

It's a very harmless 500 but it's annoying because it pings us by email and on sentry. We should have caught it in some input validation.

Comment 3

[Peter Bengtsson [:peterbe]]

PR https://github.com/mozilla/socorro/pull/2409

Comment 4

[[github robot]]

Commits pushed to master at https://github.com/mozilla/socorro

https://github.com/mozilla/socorro/commit/d288a9c734593e39796f595ecf4ca5da72c90692
fixes bug 1075030 - fuzzing throws RequiredParameterError: signature error

https://github.com/mozilla/socorro/commit/612dc98688e36275c49f69a5da0a821180e0f6c3
Merge pull request #2409 from peterbe/bug-1075030-fuzzing-throws-requiredparametererror-signature-error

fixes bug 1075030 - fuzzing throws RequiredParameterError: signature error

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on https://crash-stats.allizom.org/signature_summary/json_data?%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker%280x00109E%29%3C/scRipt%3E - I now get a 400.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot (staging)