ERROR 400 Ambiguous URI path separator #4238

ybelMekk · 2024-10-10T13:50:10Z

Current Behavior

In my test environment, I set up a Docker Compose file with Dependency-Track version 4.12.0.

In production, we are currently running version 4.11.7, and the endpoint described below works without issues, both in production and the test environment.

We make extensive use of tags, especially prior to the introduction of the new tag feature, so it's fair to say that we overuse the /project/tag endpoint.

In the latest version, however, I'm unable to query tags because I receive a ERROR 400 Ambiguous URI path separator when a request query includes a tag that contains a forward slash /.

Were there any changes in the latest release regarding the handling of UTF-8 encoded query strings? Specifically, is there now any support for queries with slashes in tags?

Steps to Reproduce

Any query escaped string containing a slash to endpoint /project/tag`.

For example:

curl -X 'GET' \
  'http://localhost:9010/api/v1/project/tag/project%3Aeurope-north1-docker.pkg.dev%2Fmy-p?pageNumber=1&pageSize=100' \
  -H 'accept: application/json' \
  -H 'X-Api-Key: my-key'

Expected Behavior

Return all projects with that tag.

Dependency-Track Version

4.12.0

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

15

Browser

Other

Checklist

I have read and understand the contributing guidelines
I have checked the existing issues for whether this defect was already reported

nscuro · 2024-10-10T15:03:27Z

Appears to be caused by a behavior change in Jetty: jetty/jetty.project#12162

ybelMekk · 2024-10-10T15:39:16Z

Thanks for quick feedback @nscuro .

nscuro · 2024-10-10T15:40:38Z

There seem to be ways to make it behave like before, I'll ensure we ship a fix with the next bugfix release.

…ment Due to a change in Jetty 12 and the Servlet API 6, it is no longer valid to pass URL-encoded values as path parameters. This is problematic for REST APIs such as Dependency-Track's, where this behavior causes endpoints to be unusable with certain parameters: DependencyTrack/dependency-track#4238 Restore the legacy behavior of Jetty 9 for now. For the next major version bump of Alpine, this can be reversed to follow Servlet API 6 more strictly.

…ment Due to a change in Jetty 12 and the Servlet API 6, it is no longer valid to pass URL-encoded values as path parameters. This is problematic for REST APIs such as Dependency-Track's, where this behavior causes endpoints to be unusable with certain parameters: DependencyTrack/dependency-track#4238 Restore the legacy behavior of Jetty 9 for now. For the next major version bump of Alpine, this can be reversed to follow Servlet API 6 more strictly. Signed-off-by: nscuro <nscuro@protonmail.com>

The *tagged projects*, *tagged policies*, and *tagged alerts* dialogs would show an empty list for tags that contain special characters such as `/`. This was caused by both DependencyTrack/dependency-track#4238, and tag names not being URI-encoded prior to using them as path parameters. Signed-off-by: nscuro <nscuro@protonmail.com>

janweinkauff · 2024-10-22T07:44:49Z

We’re experiencing the same issue and are looking forward to the fix. 🚀

nscuro · 2024-10-22T14:48:51Z

Just waiting for an Alpine release so we can pull the fix in. Will release v4.12.1 immediately afterwards, it's ready otherwise.

Fixes DependencyTrack#4238 Signed-off-by: nscuro <nscuro@protonmail.com>

Yingrjimsch · 2024-10-28T14:24:39Z

I have a self hosted dependencytrack instance where I call the endpoint api/v1/badge/violations/project/PROJECT_NAME/latest?apiKey=API_KEY where PROJECT_NAME is url encoded: test%20%2Fproject. I'm still encountering an issue and in the logs it looks like a jetty problem. Can someone help with that?

2024-10-28 13:43:54,793 ERROR [ServerRuntime$Responder] An I/O error has occurred while writing a response message entity to the container output stream.
org.glassfish.jersey.server.internal.process.MappableException: org.eclipse.jetty.io.EofException
        at org.glassfish.jersey.server.internal.MappableExceptionWrapperInterceptor.aroundWriteTo(MappableExceptionWrapperInterceptor.java:67)
        at org.glassfish.jersey.message.internal.WriterInterceptorExecutor.proceed(WriterInterceptorExecutor.java:139)
        at org.glassfish.jersey.message.internal.MessageBodyFactory.writeTo(MessageBodyFactory.java:1116)
        at org.glassfish.jersey.server.ServerRuntime$Responder.writeResponse(ServerRuntime.java:691)
        at org.glassfish.jersey.server.ServerRuntime$Responder.processResponse(ServerRuntime.java:398)
        at org.glassfish.jersey.server.ServerRuntime$Responder.process(ServerRuntime.java:388)
        at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:277)
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
        at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266)
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253)
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:696)
        at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:397)
        at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:349)
        at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:358)
        at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:312)
        at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
        at org.eclipse.jetty.ee10.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1379)
        at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1614)
        at alpine.server.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:225)
        at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586)
        at alpine.server.filters.ClickjackingFilter.doFilter(ClickjackingFilter.java:93)
        at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586)
        at alpine.server.filters.WhitelistUrlFilter.doFilter(WhitelistUrlFilter.java:166)
        at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:208)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1586)
        at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1547)
        at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:824)
        at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436)
        at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:464)
        at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:575)
        at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:717)
        at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060)
        at org.eclipse.jetty.server.Server.handle(Server.java:182)
        at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:662)
        at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:414)
        at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:322)
        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99)
        at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:478)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:441)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:293)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:201)
        at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:311)
        at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:979)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1209)
        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1164)
        at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.eclipse.jetty.io.EofException: null
        at org.eclipse.jetty.io.SocketChannelEndPoint.flush(SocketChannelEndPoint.java:117)
        at org.eclipse.jetty.io.WriteFlusher.flush(WriteFlusher.java:422)
        at org.eclipse.jetty.io.WriteFlusher.completeWrite(WriteFlusher.java:377)
        at org.eclipse.jetty.io.SelectableChannelEndPoint$2.run(SelectableChannelEndPoint.java:67)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:478)
        at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:426)
        ... 7 common frames omitted
Caused by: java.io.IOException: Broken pipe
        at java.base/sun.nio.ch.SocketDispatcher.writev0(Native Method)
        at java.base/sun.nio.ch.SocketDispatcher.writev(Unknown Source)
        at java.base/sun.nio.ch.IOUtil.write(Unknown Source)
        at java.base/sun.nio.ch.IOUtil.write(Unknown Source)
        at java.base/sun.nio.ch.SocketChannelImpl.write(Unknown Source)
        at java.base/java.nio.channels.SocketChannel.write(Unknown Source)
        at org.eclipse.jetty.io.SocketChannelEndPoint.flush(SocketChannelEndPoint.java:111)
        ... 12 common frames omitted

nscuro · 2024-10-28T14:28:56Z

@Yingrjimsch That is a different issue. org.eclipse.jetty.io.EofException basically means the client abandoned the connection before the server could send the complete response. Is that log always appearing when you request a badge?

Yingrjimsch · 2024-10-29T09:58:36Z

@Yingrjimsch That is a different issue. org.eclipse.jetty.io.EofException basically means the client abandoned the connection before the server could send the complete response. Is that log always appearing when you request a badge?

No, if I request a badge through the project ID there is no problem
Edit: My workflow requires requesting the badge throug name because the name is derivated from the git repo.
Do you know what the problem could be?
@nscuro any ideas, why this happens?

github-actions · 2024-11-30T10:06:07Z

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

ybelMekk added defect Something isn't working in triage labels Oct 10, 2024

nscuro added p2 Non-critical bugs, and features that help organizations to identify and reduce risk size/S Small effort and removed in triage labels Oct 10, 2024

nscuro added this to the 4.12.1 milestone Oct 10, 2024

nscuro self-assigned this Oct 10, 2024

nscuro mentioned this issue Oct 10, 2024

Fix breaking change due to Jetty / Servlet API URI compliance enforcement stevespringett/Alpine#683

Merged

nscuro mentioned this issue Oct 10, 2024

Fix missing URI encoding of tag names DependencyTrack/frontend#1056

Merged

1 task

nscuro added a commit to nscuro/dependency-track that referenced this issue Oct 25, 2024

Bump Alpine to 3.1.1

359e08a

Fixes DependencyTrack#4238 Signed-off-by: nscuro <nscuro@protonmail.com>

nscuro mentioned this issue Oct 25, 2024

Bump Alpine to 3.1.1 #4308

Merged

2 tasks

nscuro added a commit to nscuro/dependency-track that referenced this issue Oct 25, 2024

Bump Alpine to 3.1.1

8c37ed1

Fixes DependencyTrack#4238 Signed-off-by: nscuro <nscuro@protonmail.com>

nscuro mentioned this issue Oct 25, 2024

Backport: Bump Alpine to 3.1.1 #4309

Merged

2 tasks

nscuro closed this as completed in #4308 Oct 25, 2024

github-actions bot locked as resolved and limited conversation to collaborators Nov 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ERROR 400 Ambiguous URI path separator #4238

ERROR 400 Ambiguous URI path separator #4238

ybelMekk commented Oct 10, 2024 •

edited

Loading

nscuro commented Oct 10, 2024

ybelMekk commented Oct 10, 2024

nscuro commented Oct 10, 2024

janweinkauff commented Oct 22, 2024

nscuro commented Oct 22, 2024

Yingrjimsch commented Oct 28, 2024

nscuro commented Oct 28, 2024

Yingrjimsch commented Oct 29, 2024 •

edited

Loading

github-actions bot commented Nov 30, 2024

ERROR 400 Ambiguous URI path separator #4238

ERROR 400 Ambiguous URI path separator #4238

Comments

ybelMekk commented Oct 10, 2024 • edited Loading

Current Behavior

Steps to Reproduce

Expected Behavior

Dependency-Track Version

Dependency-Track Distribution

Database Server

Database Server Version

Browser

Checklist

nscuro commented Oct 10, 2024

ybelMekk commented Oct 10, 2024

nscuro commented Oct 10, 2024

janweinkauff commented Oct 22, 2024

nscuro commented Oct 22, 2024

Yingrjimsch commented Oct 28, 2024

nscuro commented Oct 28, 2024

Yingrjimsch commented Oct 29, 2024 • edited Loading

github-actions bot commented Nov 30, 2024

ybelMekk commented Oct 10, 2024 •

edited

Loading

Yingrjimsch commented Oct 29, 2024 •

edited

Loading