802127 - Double encoded JWT causes traceback on webpay

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P1)

Description

[Kumar McMillan [:kumar]]

I think this is caused by encoding a dict as JSON then encoding the string-dict as JSON again before creating a JWT out of it.

Traceback (most recent call last):

 File "/data/www/marketplace-dev.allizom.org-webpay/venv/lib/python2.6/site-packages/django/core/handlers/base.py", line 111, in get_response
   response = callback(request, *callback_args, **callback_kwargs)

 File "/data/www/marketplace-dev.allizom.org-webpay/venv/lib/python2.6/site-packages/django/views/decorators/http.py", line 41, in inner
   return func(request, *args, **kwargs)

 File "/data/www/marketplace-dev.allizom.org-webpay/webpay/webpay/pay/views.py", line 32, in verify
   if not form.is_valid():

 File "/data/www/marketplace-dev.allizom.org-webpay/venv/lib/python2.6/site-packages/django/forms/forms.py", line 124, in is_valid
   return self.is_bound and not bool(self.errors)

 File "/data/www/marketplace-dev.allizom.org-webpay/venv/lib/python2.6/site-packages/django/forms/forms.py", line 115, in _get_errors
   self.full_clean()

 File "/data/www/marketplace-dev.allizom.org-webpay/venv/lib/python2.6/site-packages/django/forms/forms.py", line 270, in full_clean
   self._clean_fields()

 File "/data/www/marketplace-dev.allizom.org-webpay/venv/lib/python2.6/site-packages/django/forms/forms.py", line 290, in _clean_fields
   value = getattr(self, 'clean_%s' % name)()

 File "/data/www/marketplace-dev.allizom.org-webpay/webpay/webpay/pay/forms.py", line 25, in clean_req
   app_id = payload.get('iss', '')

AttributeError: 'unicode' object has no attribute 'get'

Comment 1

[Kumar McMillan [:kumar]]

For now, this triggers a form validation error https://github.com/mozilla/webpay/commit/15f6ab5