Thumbor errors when %0A is in the filename part of the request
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• Gilles
	Nov 23 2016, 1:16 PM

Description

http://upload.wikimedia.org/wikipedia/commons/thumb/7/74/1860%0A-russian-america.jpg/250px-1860-russian-america.jpg

2016-11-23 13:13:17,217 8841 tornado.application:ERROR Future exception was never retrieved: Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/tornado/gen.py", line 230, in wrapper
    yielded = next(result)
  File "/usr/lib/python2.7/dist-packages/wikimedia_thumbor/handler/images/images.py", line 211, in check_image
    translated_kw = self.translate(kw)
  File "/usr/lib/python2.7/dist-packages/wikimedia_thumbor/handler/images/images.py", line 168, in translate
    u'File:' + kw['filename'] + u'.' + kw['extension']
  File "/usr/lib/python2.7/dist-packages/tornado/web.py", line 331, in set_header
    self._headers[name] = self._convert_header_value(value)
  File "/usr/lib/python2.7/dist-packages/tornado/web.py", line 369, in _convert_header_value
    raise ValueError("Unsafe header value %r", value)
ValueError: ('Unsafe header value %r', 'File:1860\n-russian-america.jpg')

The character isn't legit (that's not a real original's name), but the code setting the header for debugging purposes shouldn't error like that, causing the request to never return. Which in turns results in a 504.

Details

	Subject	Repo	Branch	Lines +/-
	Upgrade to 0.1.30	operations/debs/python-thumbor-wikimedia	master	+5 K -230

Customize query in gerrit

Revisions and Commits

rTHMBREXT Thumbor Plugins
	rTHMBREXT2e479eea1e15 Avoid setting invalid headers on junk input data

Related Objects
Search...

Status	Assigned	Task
Resolved	• Gilles	T121388 Service-based thumbnailing re-architecture in production with Thumbor
Resolved	• Gilles	T139606 add thumbor to production infrastructure
Resolved	• Gilles	T151453 Thumbor errors when %0A is in the filename part of the request

Event Timeline

• Gilles created this task.Nov 23 2016, 1:16 PM

• Gilles renamed this task from Thumbor can error on some characters in the filename part of the request to Thumbor errors when %0A is in the filename part of the request.Nov 23 2016, 1:21 PM

• Gilles mentioned this in T150753: Thumbor 504s on images Mediawiki 404s on.Nov 23 2016, 1:32 PM

• Gilles claimed this task.Nov 23 2016, 1:58 PM

• Gilles moved this task from Inbox, needs triage to To-do: Goals prioritized current Quarter on the Performance-Team board.Nov 23 2016, 8:24 PM

elukey unsubscribed.Nov 24 2016, 11:31 AM

• Gilles moved this task from Backlog to Doing on the Thumbor board.Nov 28 2016, 10:48 AM

• Gilles moved this task from Doing to To be packaged on the Thumbor board.Nov 28 2016, 11:21 AM

• Gilles added a commit: rTHMBREXT2e479eea1e15: Avoid setting invalid headers on junk input data.Nov 28 2016, 11:23 AM

Change 324919 had a related patch set uploaded (by Gilles):
Upgrade to 0.1.30

https://gerrit.wikimedia.org/r/324919

gerritbot added a project: Patch-For-Review.Dec 2 2016, 3:11 PM

Change 324919 merged by Filippo Giunchedi:
Upgrade to 0.1.30

https://gerrit.wikimedia.org/r/324919