Skip to content

HTTP basic auth: incorrectly padded base64 string causes an unhandled exception #4089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
6 tasks done
glarrain opened this issue May 2, 2016 · 0 comments
Closed
6 tasks done

Comments

@glarrain
Copy link
Contributor

glarrain commented May 2, 2016

The problem is in rest_framework.authentication.BasicAuthentication.authenticate. The call to base64.b64decode does not catch binascii.Error, which can be raised by binascii.a2b_base64

This assumes we want to handle that error and not let it propagate up the stack. I can't think of any reason not to, specially considering the raised exception message:

Invalid basic header. Credentials not correctly base64 encoded.

Stacktrace

Traceback (most recent call last):
  File "/app/.heroku/python/lib/python3.4/site-packages/django/core/handlers/base.py", line 149, in get_response
    response = self.process_exception_by_middleware(e, request)
  File "/app/.heroku/python/lib/python3.4/site-packages/django/core/handlers/base.py", line 147, in get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/app/.heroku/python/lib/python3.4/site-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
    return view_func(*args, **kwargs)
  File "/app/.heroku/python/lib/python3.4/site-packages/django/views/generic/base.py", line 68, in view
    return self.dispatch(request, *args, **kwargs)
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/views.py", line 466, in dispatch
    response = self.handle_exception(exc)
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/views.py", line 454, in dispatch
    self.initial(request, *args, **kwargs)
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/views.py", line 376, in initial
    self.perform_authentication(request)
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/views.py", line 310, in perform_authentication
    request.user
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/request.py", line 353, in __getattribute__
    return super(Request, self).__getattribute__(attr)
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/request.py", line 193, in user
    self._authenticate()
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/request.py", line 316, in _authenticate
    user_auth_tuple = authenticator.authenticate(self)
  File "/app/.heroku/python/lib/python3.4/site-packages/rest_framework/authentication.py", line 78, in authenticate
    auth_parts = base64.b64decode(auth[1]).decode(HTTP_HEADER_ENCODING).partition(':')
  File "/app/.heroku/python/lib/python3.4/base64.py", line 90, in b64decode
    return binascii.a2b_base64(s)
binascii.Error: Incorrect padding

Checklist

  • I have verified that that issue exists against the master branch of Django REST framework.
  • I have searched for similar issues in both open and closed tickets and cannot find a duplicate.
  • This is not a usage question. (Those should be directed to the discussion group instead.)
  • This cannot be dealt with as a third party library. (We prefer new functionality to be in the form of third party libraries where possible.)
  • I have reduced the issue to the simplest possible case.
  • I have included a failing test as a pull request. (If you are unable to do so we can still accept the issue.)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants