fix(site): prevent ExtractAPIKey from dirtying the HTML output #8450
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
90f3a55 to
df0ce70
Compare
If `httpmw.ExtractAPIKey` fails when we are rendering an HTML page, the HTML output will be dirtied with the error repsonse and the HTTP status will also be wrong. The use of this function in the `renderHTMLWithState` is additive, and failure means we simply can't embed static data. To fix this, we can simply pass a `http.ResponseWriter` that is no-op. Fixes #8351
df0ce70 to
630a40a
Compare
johnstcn
reviewed
Jul 12, 2023
site/site.go
Outdated
There was a problem hiding this comment.
Is it possible to add a unit test that ossifies this behaviour? It would be sad if we had another regression on this.
There was a problem hiding this comment.
I agree, I'm looking into this currently 👍🏻
There was a problem hiding this comment.
Covered in 54406d9 (#8450):
coder@w ~/src/coder/coder mafredri/fix-site-oauth*
❯ go test ./site -run=TestInjectionFailure -v
=== RUN TestInjectionFailureProducesCleanHTML
=== PAUSE TestInjectionFailureProducesCleanHTML
=== CONT TestInjectionFailureProducesCleanHTML
site_test.go:114:
Error Trace: /home/coder/src/coder/coder/site/site_test.go:114
Error: Not equal:
expected: 200
actual : 500
Test: TestInjectionFailureProducesCleanHTML
--- FAIL: TestInjectionFailureProducesCleanHTML (0.00s)
FAIL
FAIL github.com/coder/coder/site 0.042s
FAIL
coder@w ~/src/coder/coder mafredri/fix-site-oauth*
❯ go test ./site -run=TestInjectionFailure -v
=== RUN TestInjectionFailureProducesCleanHTML
=== PAUSE TestInjectionFailureProducesCleanHTML
=== CONT TestInjectionFailureProducesCleanHTML
site_test.go:116:
Error Trace: /home/coder/src/coder/coder/site/site_test.go:116
Error: Not equal:
expected: "<html></html>"
actual : "{\n\t\"message\": \"An internal error occurred. Please try again or contact the system administrator.\",\n\t\"detail\": \"Unable to refresh OAuth token for login type \\\"github\\\". No OAuth2Configs provided. Contact an administrator to configure this login type.\"\n}\n<html></html>"
Diff:
--- Expected
+++ Actual
@@ -1 +1,5 @@
+{
+ "message": "An internal error occurred. Please try again or contact the system administrator.",
+ "detail": "Unable to refresh OAuth token for login type \"github\". No OAuth2Configs provided. Contact an administrator to configure this login type."
+}
<html></html>
Test: TestInjectionFailureProducesCleanHTML
--- FAIL: TestInjectionFailureProducesCleanHTML (0.00s)
FAIL
FAIL github.com/coder/coder/site 0.031s
FAIL
coder@w ~/src/coder/coder mafredri/fix-site-oauth*
❯ go test ./site -run=TestInjectionFailure -v
=== RUN TestInjectionFailureProducesCleanHTML
=== PAUSE TestInjectionFailureProducesCleanHTML
=== CONT TestInjectionFailureProducesCleanHTML
--- PASS: TestInjectionFailureProducesCleanHTML (0.01s)
PASS
ok github.com/coder/coder/site 0.053s
johnstcn
reviewed
Jul 12, 2023
Comment on lines
+95
to
+99
| siteFS := fstest.MapFS{ | ||
| "index.html": &fstest.MapFile{ | ||
| Data: []byte("<html>{{ .User }}</html>"), | ||
| }, | ||
| } |
johnstcn
approved these changes
Jul 12, 2023
Emyrk
approved these changes
Jul 12, 2023
Comment on lines
+296
to
+297
| noopRW := noopResponseWriter{} | ||
| apiKey, actor, ok := httpmw.ExtractAPIKey(noopRW, r, httpmw.ExtractAPIKeyConfig{ |
There was a problem hiding this comment.
This makes a lot of sense.
I think the FE has code where if a static value is not populated statically, it defaults to using the API. so there should never be an error, just an empty static field.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If
httpmw.ExtractAPIKeyfails when we are rendering an HTML page, theHTML output will be dirtied with the error repsonse and the HTTP status
will also be wrong.
The use of this function in the
renderHTMLWithStateis additive, andfailure means we simply can't embed static data. To fix this, we can
simply pass a
http.ResponseWriterthat is no-op.Fixes #8351