-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
6.16.5.2, 6.15.5.3
Description of problem:
HTTP request failed with 500 Internal server error below when it exceeded the maximum allowed query parameter limits.
Error during failsafe response: total number of query parameters (7890) exceeds limit (4096)
Multiple issues are reported:
1. Failed to open a large puppet smart class parameter page with thousands of overrides. The following request failed. The request is supposed to be a PUT request, but incomplete query params are forwarded to Rails due to the query params limit.
ActionController::RoutingError (No route matches [POST] "/foreman_puppet/puppetclass_lookup_keys/001-test-param"):
lib/foreman/middleware/logging_context_request.rb:11:in `call'
| katello (4.11.0.20) lib/katello/prevent_json_parsing.rb:12:in `call'
2. Capsule sync failed with the following error when there are more than 4096 container repositories to sync to a Capsule.
Finished PUT /container_gateway/repository_list/ with 500 (0.71 ms) [E] <Rack::QueryParser::QueryLimitError> total number of query parameters (4222) exceeds limit (4096)
Is this issue a regression from an earlier version:
After upgrading to the Satellite (latest 6.15 and latest 6.16) which contain following security fix.
https://bugzilla.redhat.com/show_bug.cgi?id=2364966
Business Impact / Additional info:
The workaround is to allow the user to adjust the following Rack environment variable as needed for both Foreman and Foreman proxy.
RACK_QUERY_PARSER_PARAMS_LIMIT
Suggest to add a Satellite installer parameter to support this adjustment.
If this could cause a potential security breach and we don't want to support adjusting the value. We might want to make the HTTP request to reject the HTTP requests nicely. For example, instead of 500 ISE then it could be 422 Unprocessable Content status code.
Alternatively, we should implement pagination on those potential large requests.