Opened 5 years ago
Closed 5 years ago
#30852 closed Bug (duplicate)
Technical 500 page's ExceptionReporter may crash when given a POST payload with an invalid boundary
Reported by: | Keryn Knight | Owned by: | |
---|---|---|---|
Component: | Error reporting | Version: | 2.2 |
Severity: | Normal | Keywords: | |
Cc: | Triage Stage: | Unreviewed | |
Has patch: | no | Needs documentation: | no |
Needs tests: | no | Patch needs improvement: | no |
Easy pickings: | no | UI/UX: | no |
Description
Saw this on IRC yesterday, recording it as it's unlikely the user will now do so; I've sanitised the paths referenced in the traceback, but the user was on Windows using Python 3.7 - they were trying to send an AJAX request with a file attachment via FormData, but were getting it wrong...
File ".../django/core/handlers/exception.py", line 34, in inner response = get_response(request) File ".../django/utils/deprecation.py", line 94, in __call__ response = response or self.get_response(request) File ".../django/core/handlers/exception.py", line 36, in inner response = response_for_exception(request, exc) File ".../django/core/handlers/exception.py", line 90, in response_for_exception response = handle_uncaught_exception(request, get_resolver(get_urlconf()), sys.exc_info()) File ".../django/core/handlers/exception.py", line 125, in handle_uncaught_exception return debug.technical_500_response(request, *exc_info) File ".../django/views/debug.py", line 94, in technical_500_response html = reporter.get_traceback_html() File ".../django/views/debug.py", line 333, in get_traceback_html c = Context(self.get_traceback_data(), use_l10n=False) File ".../django/views/debug.py", line 305, in get_traceback_data 'filtered_POST_items': list(self.filter.get_post_parameters(self.request).items()), File ".../django/views/debug.py", line 177, in get_post_parameters return request.POST File ".../django/core/handlers/wsgi.py", line 110, in _get_post self._load_post_and_files() File ".../django/http/request.py", line 315, in _load_post_and_files self._post, self._files = self.parse_file_upload(self.META, data) File ".../django/http/request.py", line 274, in parse_file_upload parser = MultiPartParser(META, post_data, self.upload_handlers, self.encoding) File ".../django/http/multipartparser.py", line 72, in __init__ raise MultiPartParserError('Invalid boundary in multipart: %s' % boundary.decode()) AttributeError: 'NoneType' object has no attribute 'decode'
Ultimately, parse_file_upload
is intended to be allowed to raise MultiPartParserError
which is then re-raised, but MultiPartParserError
probably shouldn't be encountered when trying to render the debug page itself, so get_post_parameters
perhaps ought to handle exceptions which may occur from accessing request.POST
(for the first time? not sure)
Hi Keryn. Thank you for the report!
This is a Duplicate of #30227.