Malicious URL parser prevents app from staging

[mana]

I am still investigating in the service broker architecture of CF. I had some success with this https://github.com/spgreenberg/spring-boot-cf-service-broker-mongo.

There seems to be a bug: When the credentials contain an URI with multiple hosts (this is common for Mongo replica sets), something crashes during the staging:

2014-05-06T10:55:24.91+0200 [STG]     OUT -----> Downloaded app package (8.4M)

2014-05-06T10:55:25.35+0200 [STG]     OUT -----> Downloaded app buildpack cache (40M)

2014-05-06T10:55:25.38+0200 [API]     ERR Encountered error: Staging error: failed to stage application:

2014-05-06T10:55:25.38+0200 [API]     ERR Invalid database uri: mongodb://USER_NAME_PASS@host1:27017,host2:27017,host3:27017/b22a03f8-3e7f-4714-81ca-95160a525c4f

The JSON of the bound service looks correct:

credentials:

{ "uri" : "mongodb://USER_NAME_PASS@host1:27017,host2:27017,host3:27017/b22a03f8-3e7f-4714-81ca-95160a525c4f" }

The suspicious line of code is https://github.com/cloudfoundry/dea_ng/blob/master/lib/dea/starting/database_uri_generator.rb#L38 although it is not a relational database and this code should never be evaluating the mongo URI.

You can also reproduce this with an user provided service

$ cf cups foo -p uri

VERSION:

6.1.1-homebrew

uri> mongodb://foo:bar@host1,host2,host3/baz

Creating user provided service foo in org Playground / space development as admin...

$ cf bind-service app foo

$ cf restart app

$ cf logs app --recent

2014-05-06T11:27:50.88+0200 [API]     ERR Encountered error: Staging error: failed to stage application:

2014-05-06T11:27:50.88+0200 [API]     ERR Invalid database uri: mongodb://USER_NAME_PASS@host1,host2,host3/baz

[James Bayer]

great sleuthing!

i suspect the actual problem is here [1]

i created an issue for this [2].

[1] https://github.com/cloudfoundry/dea_ng/blob/master/lib/dea/starting/database_uri_generator.rb#L34

[2] https://github.com/cloudfoundry/dea_ng/issues/123

To unsubscribe from this group and stop receiving emails from it, send an email to vcap-dev+u...@cloudfoundry.org.

--

Thank you,

James Bayer

[mana]

Thank you for submitting a bug report ;)

Workaround:

If anyone stumbles over this issue, a quick hack would be to remove all but one host from the MongoURI. This is not the best idea when it comes to reliability! But at least the Java Mongo driver collects the information about the missing replica members from the one node and should work fine from there on.

-- mana