Merge pull request #7367 from zhongwencool/fix-bad-authorization-500-crash

fix: bad authorization format crash with 500

apps/emqx_management/src/emqx_management.app.src

@@ -1,6 +1,6 @@
 {application, emqx_management,
  [{description, "EMQ X Management API and CLI"},
-  {vsn, "4.3.13"}, % strict semver, bump manually!
+  {vsn, "4.3.11"}, % strict semver, bump manually!
   {modules, []},
   {registered, [emqx_management_sup]},
   {applications, [kernel,stdlib,minirest]},

apps/emqx_management/src/emqx_mgmt_http.erl

@@ -118,9 +118,10 @@ handle_request(_Method, _Path, Req) ->
     cowboy_req:reply(400, #{<<"content-type">> => <<"text/plain">>}, <<"Not found.">>, Req).
 
 authorize_appid(Req) ->
-    case cowboy_req:parse_header(<<"authorization">>, Req) of
+    try
-        {basic, AppId, AppSecret} -> emqx_mgmt_auth:is_authorized(AppId, AppSecret);
+        {basic, AppId, AppSecret} = cowboy_req:parse_header(<<"authorization">>, Req),
-         _  -> false
+        emqx_mgmt_auth:is_authorized(AppId, AppSecret)
+    catch _:_ -> false
     end.
 
 -ifdef(EMQX_ENTERPRISE).

apps/emqx_rule_engine/src/emqx_rule_engine.appup.src

@@ -2,11 +2,13 @@
 {VSN,
   [{"4.3.7",
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.3.6",
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.6"]}},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
@@ -15,6 +17,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.5"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -23,6 +26,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.4"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -31,6 +35,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.3"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -43,6 +48,7 @@
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {apply,{emqx_stats,cancel_update,[rule_registery_stats]}},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]}]},
@@ -51,6 +57,7 @@
      {update,emqx_rule_metrics,{advanced,["4.3.1"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {apply,{emqx_stats,cancel_update,[rule_registery_stats]}},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
@@ -70,12 +77,14 @@
    {<<".*">>,[]}],
   [{"4.3.7",
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]}]},
    {"4.3.6",
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.6"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine_api,brutal_purge,soft_purge,[]}]},
@@ -83,6 +92,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.5"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -91,6 +101,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.4"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_runtime,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -99,6 +110,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.3"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_actions,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -108,6 +120,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.2"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {apply,{emqx_stats,cancel_update,[rule_registery_stats]}},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
@@ -118,6 +131,7 @@
     [{load_module,emqx_rule_utils,brutal_purge,soft_purge,[]},
      {update,emqx_rule_metrics,{advanced,["4.3.1"]}},
      {load_module,emqx_rule_events,brutal_purge,soft_purge,[]},
+     {load_module,emqx_rule_funcs,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_engine,brutal_purge,soft_purge,[]},
      {load_module,emqx_rule_registry,brutal_purge,soft_purge,[]},
      {apply,{emqx_stats,cancel_update,[rule_registery_stats]}},

lib-ce/emqx_dashboard/src/emqx_dashboard.erl

@@ -103,17 +103,17 @@ is_authorized(Req) ->
 is_authorized("/api/v4/auth", _Req) ->
     true;
 is_authorized(_Path, Req) ->
-    case cowboy_req:parse_header(<<"authorization">>, Req) of
+    try
-        {basic, Username, Password} ->
+        {basic, Username, Password} = cowboy_req:parse_header(<<"authorization">>, Req),
-            case emqx_dashboard_admin:check(iolist_to_binary(Username),
+        case emqx_dashboard_admin:check(iolist_to_binary(Username), iolist_to_binary(Password)) of
-                                            iolist_to_binary(Password)) of
+            ok -> true;
-                ok -> true;
+            {error, Reason} ->
-                {error, Reason} ->
+                ?LOG(error, "[Dashboard] Authorization Failure: username=~s, reason=~p",
-                    ?LOG(error, "[Dashboard] Authorization Failure: username=~s, reason=~p",
+                    [Username, Reason]),
-                                [Username, Reason]),
+                false
-                    false
+        end
-            end;
+    catch _:_ -> %% bad authorization header will crash.
-         _  -> false
+        false
     end.
 
 filter(#{app := emqx_modules}) -> true;