Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 131476 - Untested, invalid devaway.xml copied to www.g.o breaks roll-call
Summary: Untested, invalid devaway.xml copied to www.g.o breaks roll-call
Status: RESOLVED FIXED
Alias: None
Product: Websites
Classification: Unclassified
Component: [OLD] Project Web Spaces (show other bugs)
Hardware: All Linux
: Highest major (vote)
Assignee: Gentoo Infrastructure
URL: http://www.gentoo.org/proj/en/devrel/...
Whiteboard:
Keywords:
Depends on:
Blocks: 122395
  Show dependency tree
 
Reported: 2006-04-27 09:24 UTC by Matej Stepanek
Modified: 2008-07-12 20:28 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matej Stepanek 2006-04-27 09:24:52 UTC
The page http://www.gentoo.org/main/en/articles.xml under the link "Developer List" links to the URL "http://www.gentoo.org/proj/en/devrel/roll-call/userinfo.xml" which reads

"Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, www@gentoo.org and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Apache/1.3.33 Server at www.gentoo.org Port 80"

I suggest the internal server error to be fixed.
Comment 1 nm (RETIRED) gentoo-dev 2006-04-27 09:29:19 UTC
Give it a little bit of time and try again. Sometimes these things happen. We aren't responsible for anything under /proj/en/ besides /proj/en/gdp anyway.
Comment 2 Shyam Mani (RETIRED) gentoo-dev 2006-04-27 09:34:39 UTC
I'm re-assigning this to web team.
Comment 3 Shyam Mani (RETIRED) gentoo-dev 2006-04-27 09:41:50 UTC
Okay, local copy of the exact same page works fine on gorg, but gives a 500 and other errors on the webnodes.
Comment 4 Xavier Neys (RETIRED) gentoo-dev 2006-04-27 10:21:46 UTC
/dyn/devaway/devaway.xml is empty.
Caused by the current migration of d.g.o, but the script could check the file before it overwrites the live copy.
Use http://gentoo.neysx.org/proj/en/devrel/roll-call/userinfo.xml until the migration is completed.
Comment 5 Matej Stepanek 2006-04-28 11:21:48 UTC
I think the proper closing of the bug is not INVALID, but FIXED.
If the visitor is supposed to try again in case of a deadlink, then I suggest the 404 message to contain the timeout period after which the visitor should try again and only after that file the bug. Because otherwise it's not clear what the timeout period should be.
Comment 6 Xavier Neys (RETIRED) gentoo-dev 2006-04-28 11:34:51 UTC
(In reply to comment #5)
> I think the proper closing of the bug is not INVALID, but FIXED.
> If the visitor is supposed to try again in case of a deadlink, then I suggest
> the 404 message to contain the timeout period after which the visitor should
> try again and only after that file the bug. Because otherwise it's not clear
> what the timeout period should be.

What dead link, what closing of the bug, what 404. Nonsense! Stop it, please.
Comment 7 Lance Albertson (RETIRED) gentoo-dev 2006-04-29 14:24:02 UTC
Looks like its working again. Please reopen if this isn't the case.
Comment 8 Xavier Neys (RETIRED) gentoo-dev 2006-05-01 08:28:35 UTC
Reopening so that we can check the script will not overwrite a valid file with an invalid or identical one, something more like:

# Download devaway from woodpecker

curl -s -o tmp.devaway http://dev.gentoo.org/devaway/xml/
xmllint --valid --noout tmp.devaway
if [ $? -eq 0 ]; then
  diff tmp.devaway $W/dyn/devaway/devaway.xml  2>/dev/null 1>&2
  if [ $? -ne 0 ]; then
    mv tmp.devaway $W/dyn/devaway/devaway.xml
  fi
fi
Comment 9 Xavier Neys (RETIRED) gentoo-dev 2006-06-26 02:54:17 UTC
zer0-length or invalid devaway.xml will break www.g.o

There's a good reason CVS rejects invalid xml files which means the error could not be in userinfo.xml itself. Unfortunately, scripts (and their coders) are not as clever and inject broken files into www.g.o

Look at nixnut's entry.
FYI, it started Sunday 25 between 11:15 +0200 and 12:15 +0200

In gentoo.neysx.org's mailbox:
tmp.devaway:39: parser error : Input is not proper UTF-8, indicate encoding !
Bytes: 0xC2 0x67 0x6F 0x6E
<dev nick='nixnut'><reason>
Comment 10 Xavier Neys (RETIRED) gentoo-dev 2006-06-26 02:54:17 UTC
zer0-length or invalid devaway.xml will break www.g.o

There's a good reason CVS rejects invalid xml files which means the error could not be in userinfo.xml itself. Unfortunately, scripts (and their coders) are not as clever and inject broken files into www.g.o

Look at nixnut's entry.
FYI, it started Sunday 25 between 11:15 +0200 and 12:15 +0200

In gentoo.neysx.org's mailbox:
tmp.devaway:39: parser error : Input is not proper UTF-8, indicate encoding !
Bytes: 0xC2 0x67 0x6F 0x6E
<dev nick='nixnut'><reason>Âgone from june 25th till july 1st</reason></dev>
                           ^
Comment 11 Curtis Napier (RETIRED) gentoo-dev 2006-07-12 03:22:29 UTC
(In reply to comment #8)
> Reopening so that we can check the script will not overwrite a valid file with
> an invalid or identical one, something more like:
> 
> # Download devaway from woodpecker
> 
> curl -s -o tmp.devaway http://dev.gentoo.org/devaway/xml/
> xmllint --valid --noout tmp.devaway
> if [ $? -eq 0 ]; then
>   diff tmp.devaway $W/dyn/devaway/devaway.xml  2>/dev/null 1>&2
>   if [ $? -ne 0 ]; then
>     mv tmp.devaway $W/dyn/devaway/devaway.xml
>   fi
> fi
> 

My understanding is that the above script should be inserted into /home/gweb/scripts/master/devaway.sh on loon. This would solve the bug as fixed. The resulting devaway.sh would be this:

***************************************************************************

#!/bin/bash
# $Id: devaway.sh,v 1.2 2005/12/12 03:47:56 ramereth Exp $
# $1 = staging htdocs directory

PATH=/bin:/usr/bin:$PATH

DOCROOT=$1
MASTER="http://dev.gentoo.org/devaway/xml/index.php"

[ -z ${DOCROOT} ] && echo "Webroot is not set, exiting" && exit 1
install -d ${DOCROOT%/}/dyn/devaway
cd ${DOCROOT%/}/dyn/devaway
/usr/bin/wget --quiet -O ${DOCROOT%/}/dyn/devaway/tmp.devaway. ${MASTER}
 xmllint --valid --noout ${DOCROOT%/}/dyn/devaway/tmp.devaway
 if [ $? -eq 0 ]; then
   diff ${DOCROOT%/}/dyn/devaway/tmp.devaway ${DOCROOT%/}/dyn/devaway/dyn/devaway/devaway.xml  2>/dev/null 1>&2
   if [ $? -ne 0 ]; then
     mv ${DOCROOT%/}/dyn/devaway/tmp.devaway ${DOCROOT%/}/dyn/devaway/dyn/devaway/devaway.xml
     chmod 644 ${DOCROOT%/}/dyn/devaway/devaway.xml
   fi
 fi

***************************************************************************

The cfengine part of it I'm not sure about. I looked over the cf.www config and I don't see the devaway.sh script mentioned so I don't think it's being protected by cfengine. 

If the above script is correct (and I'm pretty sure it's not so would someone look it over please?) and the devaway.sh script *isn't* protected by cfengine (Lance will you confirm this?) then I (or neysx) have the proper perms on loon to get this bug closed. 

If it is protected by cfengine Lance, will you make this happen or should it wait for the wwwnode upgrade?



ps The roll-call page breaks on a regular basis and I get a lot of mail about it on www@g.o......

Comment 12 Curtis Napier (RETIRED) gentoo-dev 2006-07-12 03:40:45 UTC
I just realized I was looking at the wrong cfengine config, cf.gweb protects the devaway.sh script. 
Comment 13 Xavier Neys (RETIRED) gentoo-dev 2006-09-18 07:48:27 UTC
Script looks fine to me with the exception I would not save the temp file inside the staging dir but in /tmp or ~
Comment 14 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2007-04-17 22:40:53 UTC
the script that generates the initial dev.Status file is now fixed to only generate well-formed output.
You should probably still have checking on the web side for cases where the connection is terminated partway.
Comment 15 Xavier Neys (RETIRED) gentoo-dev 2007-04-17 23:53:43 UTC
(In reply to comment #14)
> the script that generates the initial dev.Status file is now fixed to only
> generate well-formed output.

Sorry, but how could dev.Status be well-formed when it's not even xml?

> You should probably still have checking on the web side for cases where the
> connection is terminated partway.

You already have a script, it's been here for a while.
Comment 16 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2007-04-18 00:45:13 UTC
well-formed is a general term.
I didn't state it was well-formed XML. I simply said it was well-formed.
The dev.Status format being:
"$dev, $status\n"
with $status being non-empty, WITHOUT linebreaks, and not containing any malicious data.
The first line of .away forms the $status content.
Comment 17 Xavier Neys (RETIRED) gentoo-dev 2007-04-18 08:22:21 UTC
XML still needs to be tested for validity before the one in place can be overwritten.
If I'm expected to do it myself, which I don't mind, will someone please tell me where to put the script? Thanks.
Comment 18 Xavier Neys (RETIRED) gentoo-dev 2007-06-07 10:43:19 UTC
$ curl -D - http://wren.gentoo.org/dyn/devaway/devaway.xml?passthru=1
HTTP/1.1 200 OK
Date: Thu, 07 Jun 2007 07:04:15 GMT
Server: Apache
ETag: "0-4666d2c8"
Content-Length: 0
Last-Modified: Wed, 06 Jun 2007 15:29:12 GMT
Vary: Accept-Encoding
Content-Type: text/plain; charset=utf-8

Untested devaway.xml on wren has 0 byte long which breaks both devaway & devlist

$ curl -D - http://wren.gentoo.org/proj/en/devrel/roll-call/userinfo.xml
HTTP/1.1 500 Internal Server Error
Date: Thu, 07 Jun 2007 10:39:45 GMT
Comment 19 Mike Doty (RETIRED) gentoo-dev 2007-06-07 15:37:44 UTC
(In reply to comment #18)
> $ curl -D - http://wren.gentoo.org/dyn/devaway/devaway.xml?passthru=1
> HTTP/1.1 200 OK
> Date: Thu, 07 Jun 2007 07:04:15 GMT
> Server: Apache
> ETag: "0-4666d2c8"
> Content-Length: 0
> Last-Modified: Wed, 06 Jun 2007 15:29:12 GMT
> Vary: Accept-Encoding
> Content-Type: text/plain; charset=utf-8
> 
> Untested devaway.xml on wren has 0 byte long which breaks both devaway &
> devlist
> 
> $ curl -D - http://wren.gentoo.org/proj/en/devrel/roll-call/userinfo.xml
> HTTP/1.1 500 Internal Server Error
> Date: Thu, 07 Jun 2007 10:39:45 GMT
> 

wren had some connectivity issues yesterday, I'd chalk up anything broken that pulls from the net to that.
Comment 20 Xavier Neys (RETIRED) gentoo-dev 2007-06-07 15:44:11 UTC
(In reply to comment #19)
> wren had some connectivity issues yesterday, I'd chalk up anything broken that
> pulls from the net to that.

The fact remains that the valid file was overwritten by an untested invalid one.
Comment 21 Xavier Neys (RETIRED) gentoo-dev 2007-06-16 09:39:58 UTC
$ curl -D - http://www.gentoo.org/proj/en/devrel/roll-call/userinfo.xml
HTTP/1.1 500 Internal Server Error

FYI, roll-call and devaway gave an error 500 again when woodpecker was down.

Comment 22 Xavier Neys (RETIRED) gentoo-dev 2007-09-12 15:46:01 UTC
Both dev list & devaway are broken again. An untested invalid xml file was copied over to www.g.o, again, and again...

Internal Server Error
xmlErrMsg:Input is not proper UTF-8, indicate encoding ! Bytes: 0xC2 0x3C 0x2F 0x72
xmlErrLevel:3
xmlErrCode:9

Comment 23 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2008-07-12 20:28:47 UTC
Fixed in CVS.

/var/cvsroot/gentoo-infra/cfengine/files/home/gweb/scripts/master/devaway.sh,v  <--  devaway.sh
new revision: 1.3; previous revision: 1.2