Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 706170 - glsamaker bugzilla integration has a potential bug
Summary: glsamaker bugzilla integration has a potential bug
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Misc (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-01-23 16:25 UTC by Alec Warner (RETIRED)
Modified: 2022-08-11 02:35 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alec Warner (RETIRED) archtester gentoo-dev Security 2020-01-23 16:25:50 UTC
In lib/bugzilla.rb there is a file_bug function. We have 2 observations where this function fails. The code has a flow like:

def file_bug(..)
  try:
    Bugzilla.bug.New(..)
  rescue Error as e:
    if e.errorcode = 410:
      Bugzilla.Login()
  finally:
    ...

So the concept here is that we will try to file the bug and if our cookies are expired, we will trigger a login that gets new cookies. However recent observations imply that this rescue handler (that attempts to login on failure) is not working properly, leaving the application unable to login to bugzilla and thus breaking the bugzilla integration.

This was fixed temporarily by adding Bugzilla.Login() to the top of file_bug. However this seems less than ideal as it will cause a lot of traffic to bugzilla.

I believe we can either:
 - Figure out what error code bugzilla is sending; it appears 410 is no longer correct.
 - Decide to do something like:
  if not (Bugzilla.HasCookie() or Bugzilla.CookieExpired()):
    Bugzilla.Login()
  (...the rest of file_bug)
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2020-01-23 18:20:37 UTC
2 ideas:

1) Maybe we can convert that Bugzilla class to use real API key usage. Using API key will avoid dealing with cookies, not?


2) We could make check for error code less strict. I.e. it should be fine to try login for any 4xx code (keep in mind that we set retry flag so we will error out when second attempt will fail).
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-11 02:35:08 UTC
glsamakerv2 is dead