Skip to content
Snippets Groups Projects

500 Internal Server Error: Creating project with malformed "request_access_enabled"

    • Closed Issue created by Vaggelis Atlidakis @vatlidak1

    Summary

    500 Internal Server Error when creating project with malformed "request_access_enabled"

    Example

    echo -e '{"request_acc\x98ss_enabled":"85e8324a90cf487eb25d574"}' | curl -v -X 'POST'  -H "Content-Type: application/json" -H 'PRIVATE-TOKEN: [FILTERED]' 'http://127.0.0.1/api/v4/projects/' -d @-

    Example Project

    The bug is reproducible on "gitlab.com" and on our local deployment with source code installation of enterprise edition (13-0-stable branch).

    What is the current bug behavior?

    HTTP Response: "500 Internal Server Error."

    What is the expected correct behavior?

    HTTP Response: "400 Bad Request: {"error":"request_access_enabled is invalid"}"

    Relevant logs and/or screenshots

    
==> /home/git/gitlab/log/production.log <==
Started POST "/api/v4/groups" for 127.0.0.1 at 2020-08-07 16:55:40 +0000

==> /home/git/gitlab/log/api_json.log <==
{"time":"2020-08-07T16:55:40.468Z","severity":"INFO","duration_s":0.01462,"db_duration_s":0.00112,"view_duration_s":0.0135,"status":500,"method":"POST","path":"/api/v4/groups","params":[{"key":"lfs_enabled","value":"true"},{"key":"request_access_enabled","value":"false"},{"key":"name","value":"70328800b01940b78ffcf462a6f4b9594"},{"key":"path","value":"�"},{"key":"visibility","value":"internal"},{"key":"description","value":"[FILTERED]"}],"host":"127.0.0.1","remote_ip":"127.0.0.1, 127.0.0.1","ua":"curl/7.58.0","route":"/api/:version/groups","user_id":1,"username":"root","queue_duration_s":0.011672,"redis_calls":1,"redis_duration_s":0.00023,"correlation_id":"xh1LR6APQEa","meta.user":"root","meta.caller_id":"/api/:version/groups"}

==> /home/git/gitlab/log/production.log <==

JSON::GeneratorError (partial character in source, but hit end):

lib/gitlab/json_logger.rb:22:in `format_message'
lib/gitlab/logger.rb:14:in `error'
lib/gitlab/error_tracking.rb:139:in `process_exception'
lib/gitlab/error_tracking.rb:93:in `track_exception'
lib/api/helpers.rb:440:in `block in handle_api_exception'
lib/gitlab/error_tracking.rb:48:in `with_context'
lib/api/helpers.rb:439:in `handle_api_exception'
lib/api/api.rb:98:in `block in <class:API>'
lib/gitlab/request_profiler/middleware.rb:17:in `call'
lib/gitlab/middleware/go.rb:20:in `call'
lib/gitlab/etag_caching/middleware.rb:13:in `call'
lib/gitlab/middleware/multipart.rb:125:in `call'
lib/gitlab/middleware/read_only/controller.rb:51:in `call'
lib/gitlab/middleware/read_only.rb:18:in `call'
lib/gitlab/middleware/same_site_cookies.rb:27:in `call'
lib/gitlab/middleware/basic_health_check.rb:25:in `call'
lib/gitlab/middleware/request_context.rb:23:in `call'
config/initializers/fix_local_cache_middleware.rb:9:in `call'
lib/gitlab/metrics/requests_rack_middleware.rb:60:in `call'
lib/gitlab/middleware/release_env.rb:12:in `call'

==> /home/git/gitlab/log/gitlab-workhorse.log <==
127.0.0.1 127.0.0.1 - - [2020/08/07:16:55:40 +0000] "POST /api/v4/groups HTTP/1.1" 500 2926 "" "curl/7.58.0" 28

    Results of GitLab application Check

    Checking GitLab subtasks ...       
                
Checking GitLab Shell ...                           
                                                  
GitLab Shell: ... GitLab Shell version >= 13.2.0 ? ... OK (13.2.0)
Running /home/git/gitlab-shell/bin/check
Internal API available: OK                
Redis available via internal API: OK         
gitlab-shell self-check successful                                
                                           
Checking GitLab Shell ... Finished
                                
Checking Gitaly ...

Gitaly: ... default ... OK           

Checking Gitaly ... Finished                                                                                                                                                                                                                 

Checking Sidekiq ...

Sidekiq: ... Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished
Checking GitLab App ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet)
Init script exists? ... yes
Init script up-to-date? ... yes
Projects have namespace: ... can't check, you have no projects
Redis version >= 4.0.0? ... yes
Ruby version >= 2.5.3 ? ... yes (2.6.6)
Git version >= 2.22.0 ? ... yes (2.27.0)
Git user has default SSH configuration? ... yes
Active users: ... 1
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes

Checking GitLab App ... Finished

Checking GitLab subtasks ... Finished

    Comments

    This bug was found using REST API fuzzing.

    Designs

    Child items ...

    • Activity

    Please register or sign in to reply