Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CT client upload to be safe against no-op POSTs #1424

Merged
merged 2 commits into from
Apr 15, 2024
Merged

Fix CT client upload to be safe against no-op POSTs #1424

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d899ffa
Fix CT client upload to be safe against no-op POSTs
mhutchinson Apr 11, 2024
ac17682
Fixed method mismatch in the reported error
mhutchinson Apr 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions internal/witness/client/http/witness_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ func (w Witness) GetLatestSTH(ctx context.Context, logID string) ([]byte, error)
if err != nil {
return nil, fmt.Errorf("failed to parse URL: %v", err)
}
req, err := http.NewRequest("GET", u.String(), nil)
req, err := http.NewRequest(http.MethodGet, u.String(), nil)
if err != nil {
return nil, fmt.Errorf("failed to create request: %v", err)
}
Expand Down Expand Up @@ -75,7 +75,7 @@ func (w Witness) Update(ctx context.Context, logID string, sth []byte, proof [][
if err != nil {
return nil, fmt.Errorf("failed to parse URL: %v", err)
}
req, err := http.NewRequest("PUT", u.String(), bytes.NewReader(reqBody))
req, err := http.NewRequest(http.MethodPut, u.String(), bytes.NewReader(reqBody))
if err != nil {
return nil, fmt.Errorf("failed to create request: %v", err)
}
Expand Down
4 changes: 4 additions & 0 deletions jsonclient/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,10 @@ func (c *JSONClient) PostAndParse(ctx context.Context, path string, req, rsp int
}
return nil, nil, err
}
if httpRsp.Request.Method != http.MethodPost {
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections#permanent_redirections
return nil, nil, fmt.Errorf("PUT request to %q was converted to %s request to %q", fullURI, httpRsp.Request.Method, httpRsp.Request.URL)
}

if httpRsp.StatusCode == http.StatusOK {
if err = json.Unmarshal(body, &rsp); err != nil {
Expand Down
18 changes: 9 additions & 9 deletions trillian/ctfe/handlers_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,7 +311,7 @@ func TestGetRoots(t *testing.T) {
defer info.mockCtrl.Finish()
handler := AppHandler{Info: info.li, Handler: getRoots, Name: "GetRoots", Method: http.MethodGet}

req, err := http.NewRequest("GET", "http://example.com/ct/v1/get-roots", nil)
req, err := http.NewRequest(http.MethodGet, "http://example.com/ct/v1/get-roots", nil)
if err != nil {
t.Fatalf("Failed to create request: %v", err)
}
Expand Down Expand Up @@ -420,7 +420,7 @@ func TestAddChainWhitespace(t *testing.T) {

recorder := httptest.NewRecorder()
handler := AppHandler{Info: info.li, Handler: addChain, Name: "AddChain", Method: http.MethodPost}
req, err := http.NewRequest("POST", "http://example.com/ct/v1/add-chain", strings.NewReader(test.body))
req, err := http.NewRequest(http.MethodPost, "http://example.com/ct/v1/add-chain", strings.NewReader(test.body))
if err != nil {
t.Fatalf("Failed to create POST request: %v", err)
}
Expand Down Expand Up @@ -775,7 +775,7 @@ func TestGetSTH(t *testing.T) {
srReq.ChargeTo = &trillian.ChargeTo{User: []string{test.wantQuotaUser}}
}
info.client.EXPECT().GetLatestSignedLogRoot(deadlineMatcher(), cmpMatcher{srReq}).Return(test.rpcRsp, test.rpcErr)
req, err := http.NewRequest("GET", "http://example.com/ct/v1/get-sth", nil)
req, err := http.NewRequest(http.MethodGet, "http://example.com/ct/v1/get-sth", nil)
if err != nil {
t.Errorf("Failed to create request: %v", err)
return
Expand Down Expand Up @@ -1010,7 +1010,7 @@ func TestGetEntries(t *testing.T) {
info.setRemoteQuotaUser(test.wantQuotaUser)
handler := AppHandler{Info: info.li, Handler: getEntries, Name: "GetEntries", Method: http.MethodGet}
path := fmt.Sprintf("/ct/v1/get-entries?%s", test.req)
req, err := http.NewRequest("GET", path, nil)
req, err := http.NewRequest(http.MethodGet, path, nil)
if err != nil {
t.Errorf("Failed to create request: %v", err)
continue
Expand Down Expand Up @@ -1187,7 +1187,7 @@ func TestGetEntriesRanges(t *testing.T) {
}

path := fmt.Sprintf("/ct/v1/get-entries?start=%d&end=%d", test.start, test.end)
req, err := http.NewRequest("GET", path, nil)
req, err := http.NewRequest(http.MethodGet, path, nil)
if err != nil {
t.Fatalf("Failed to create request: %v", err)
}
Expand Down Expand Up @@ -1444,7 +1444,7 @@ func TestGetProofByHash(t *testing.T) {

for _, test := range tests {
info.setRemoteQuotaUser(test.wantQuotaUser)
req, err := http.NewRequest("GET", fmt.Sprintf("/ct/v1/proof-by-hash?%s", test.req), nil)
req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/ct/v1/proof-by-hash?%s", test.req), nil)
if err != nil {
t.Errorf("Failed to create request: %v", err)
continue
Expand Down Expand Up @@ -1792,7 +1792,7 @@ func TestGetSTHConsistency(t *testing.T) {

for _, test := range tests {
info.setRemoteQuotaUser(test.wantQuotaUser)
req, err := http.NewRequest("GET", fmt.Sprintf("/ct/v1/get-sth-consistency?%s", test.req), nil)
req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/ct/v1/get-sth-consistency?%s", test.req), nil)
if err != nil {
t.Errorf("Failed to create request: %v", err)
continue
Expand Down Expand Up @@ -2126,7 +2126,7 @@ func TestGetEntryAndProof(t *testing.T) {

for _, test := range tests {
info.setRemoteQuotaUser(test.wantQuotaUser)
req, err := http.NewRequest("GET", fmt.Sprintf("/ct/v1/get-entry-and-proof?%s", test.req), nil)
req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/ct/v1/get-entry-and-proof?%s", test.req), nil)
if err != nil {
t.Errorf("Failed to create request: %v", err)
continue
Expand Down Expand Up @@ -2250,7 +2250,7 @@ func makeAddChainRequest(t *testing.T, li *logInfo, body io.Reader) *httptest.Re

func makeAddChainRequestInternal(t *testing.T, handler AppHandler, path string, body io.Reader) *httptest.ResponseRecorder {
t.Helper()
req, err := http.NewRequest("POST", fmt.Sprintf("http://example.com/ct/v1/%s", path), body)
req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("http://example.com/ct/v1/%s", path), body)
if err != nil {
t.Fatalf("Failed to create POST request: %v", err)
}
Expand Down
Loading