Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parsing database objects names as String #1984

Open
1 of 3 tasks
uCatu opened this issue Dec 28, 2020 · 0 comments
Open
1 of 3 tasks

Parsing database objects names as String #1984

uCatu opened this issue Dec 28, 2020 · 0 comments

Comments

@uCatu
Copy link
Contributor

uCatu commented Dec 28, 2020

Summary

When allowing tenant to supply their own DB name and external connection we are exposed to different object naming conventions for example, database 2020conjuror role 2020conjur_role

When the object starts with integer, Conjur fails to convert it to String - leading us to errors like so when loading policy (we create temp schema for each load policy):

origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30]   Parameters: {:controller=>"policies", :action=>"post", :account=>"cyberark", :kind=>"policy", :identifier=>"root"}
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] CONJ00034I Primary schema is "7cf9dc1893384296be9774b6269eb08b"
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] Completed 500 Internal Server Error in 25ms
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30]
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] Sequel::DatabaseError (PG::SyntaxError: ERROR:  syntax error at or near "7"
LINE 1: CREATE TABLE roles AS SELECT * FROM 7cf9dc1893384296be9774b6...
                                                                                   ^
):
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30]
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/models/loader/orchestrate.rb:353:in `block in create_schema'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/models/loader/orchestrate.rb:352:in `each'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/models/loader/orchestrate.rb:352:in `create_schema'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/models/loader/orchestrate.rb:85:in `setup_db_for_new_policy'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/models/loader/create_policy.rb:15:in `call'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/controllers/policies_controller.rb:59:in `perform'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/controllers/policies_controller.rb:47:in `post'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/controllers/application_controller.rb:74:in `block in run_with_transaction'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] app/controllers/application_controller.rb:73:in `run_with_transaction'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] lib/rack/remove_request_parameters.rb:26:in `call'
[origin=192.168.11.174] [request_id=e5751dd9-2707-481a-85b9-2c3ca10947db] [tid=30] lib/rack/default_content_type.rb:68:in `call'

The error source can be found here orchestrate.rb and here schemata.rb, however it is not limited to those references and can occur in different flows, we should escape and convert each database object (db name, role name & schema name etc.) to Strings

Steps to Reproduce

Steps to reproduce the behavior:

  1. Create DB/Schema/Role starting with integer
  2. Supply it into Conjur by external DB url and not proprietary DB usage flow
  3. Run load policy

Expected Results

200 OK and loaded policy

Actual Results (including error logs, if applicable)

500 Server error with stack trace above

Reproducible

  • Always
  • Sometimes
  • Non-Reproducible

Version/Tag number

all

Environment setup

External DB setup, helm/docker-copmose

Additional Information

None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant