New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 721388 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 720511
Owner: ----
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Apache server for CSP LayoutTests failed on two shards

Project Member Reported by iclell...@chromium.org, May 11 2017

Issue description

Running layout tests in this build:
https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_rel_ng/builds/451755

Two CSP-related directive parsing tests failed, with an internal server error being reported from the local Apache server.

(Unexpected Failures:
* http/tests/security/contentSecurityPolicy/directive-parsing-03.html
* http/tests/security/contentSecurityPolicy/source-list-parsing-04.html)

The tests attempt to request a document from the server, which should return a document with an invalid CSP header. (Contains \x07, \x08 or \x09 characters embedded in the header).

In this instance (presumably this doesn't happen all the time), the running server failed to return the document, and instead failed and returned a 500 ISE.

The error logs from the server show this:
(https://storage.googleapis.com/chromium-layout-test-archives/linux_chromium_rel_ng/451755/layout-test-results/error_log.txt)

[Thu May 11 07:59:01.081240 2017] [http:error] [pid 11812] [client 127.0.0.1:56346] AH02430: Response header 'Content-Security-Policy' value of 'script-src 'none'; a\x07aa ; ' contains invalid characters, aborting request, referer: http://127.0.0.1:8000/security/contentSecurityPolicy/directive-parsing-03.html
[Thu May 11 07:59:03.129059 2017] [http:error] [pid 11226] [client 127.0.0.1:56350] AH02430: Response header 'Content-Security-Policy' value of 'script-src 'none'; a\x07aa ; ' contains invalid characters, aborting request, referer: http://127.0.0.1:8000/security/contentSecurityPolicy/directive-parsing-03.html
[Thu May 11 07:59:04.027315 2017] [http:error] [pid 15725] [client 127.0.0.1:56351] AH02430: Response header 'Content-Security-Policy' value of 'script-src 'none'; a\x07aa ; ' contains invalid characters, aborting request, referer: http://127.0.0.1:8000/security/contentSecurityPolicy/directive-parsing-03.html
[Thu May 11 07:59:05.156376 2017] [mpm_prefork:notice] [pid 3454] AH00169: caught SIGTERM, shutting down
[Thu May 11 07:59:33.760324 2017] [http:error] [pid 24533] [client 127.0.0.1:46806] AH02430: Response header 'Content-Security-Policy' value of 'script-src https:  \b' contains invalid characters, aborting request, referer: http://127.0.0.1:8000/security/contentSecurityPolicy/source-list-parsing-04.html
[Thu May 11 07:59:41.247468 2017] [mpm_prefork:notice] [pid 22502] AH00169: caught SIGTERM, shutting down
[Thu May 11 07:59:41.417751 2017] [http:error] [pid 24151] [client 127.0.0.1:46818] AH02430: Response header 'Content-Security-Policy' value of 'script-src https:  \b' contains invalid characters, aborting request, referer: http://127.0.0.1:8000/security/contentSecurityPolicy/source-list-parsing-04.html
[Thu May 11 07:59:43.028394 2017] [http:error] [pid 24374] [client 127.0.0.1:46822] AH02430: Response header 'Content-Security-Policy' value of 'script-src https:  \b' contains invalid characters, aborting request, referer: http://127.0.0.1:8000/security/contentSecurityPolicy/source-list-parsing-04.html


Failing shards:
https://chromium-swarm.appspot.com/task?id=3610c9a712d69810&refresh=10&show_raw=1
https://chromium-swarm.appspot.com/task?id=3610c9a811ea3210&refresh=10&show_raw=1


Test results show only the unhelpful:

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error log.

Apache Server at 127.0.0.1 Port 80
 
Cc: lunalu@chromium.org
Also visible in the server access.log:

127.0.0.1 - - [11/May/2017:07:59:01 -0700] "GET /security/contentSecurityPolicy/directive-parsing-03.html HTTP/1.1" 200 512
127.0.0.1 - - [11/May/2017:07:59:01 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?should_run=no&q=http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js&csp=script-src%20%27none%27%3B%20a%07aa%20%3B%20 HTTP/1.1" 500 776
...
127.0.0.1 - - [11/May/2017:07:59:03 -0700] "GET /security/contentSecurityPolicy/directive-parsing-03.html HTTP/1.1" 200 512
127.0.0.1 - - [11/May/2017:07:59:03 -0700] "GET /security/contentSecurityPolicy/directive-parsing-03.html HTTP/1.1" 200 512
127.0.0.1 - - [11/May/2017:07:59:03 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?should_run=no&q=http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js&csp=script-src%20%27none%27%3B%20a%07aa%20%3B%20 HTTP/1.1" 500 776
127.0.0.1 - - [11/May/2017:07:59:04 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?should_run=no&q=http://127.0.0.1:8000/security/contentSecurityPolicy/resources/script.js&csp=script-src%20%27none%27%3B%20a%07aa%20%3B%20 HTTP/1.1" 500 776

and later:

127.0.0.1 - - [11/May/2017:07:59:41 -0700] "GET /security/contentSecurityPolicy/source-list-parsing-04.html HTTP/1.1" 200 540
...
127.0.0.1 - - [11/May/2017:07:59:42 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?experimental=false&should_run=no&csp=script-src%20https%3A%20%20taco&q=/security/contentSecurityPolicy/resources%2Fscript.js HTTP/1.1" 200 165
127.0.0.1 - - [11/May/2017:07:59:42 -0700] "GET /security/contentSecurityPolicy/resources/multiple-iframe-test.js HTTP/1.1" 200 1458
127.0.0.1 - - [11/May/2017:07:59:42 -0700] "GET /security/contentSecurityPolicy/source-list-parsing-04.html HTTP/1.1" 200 540
127.0.0.1 - - [11/May/2017:07:59:43 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?experimental=false&should_run=no&csp=script-src%20%27none%27&q=/security/contentSecurityPolicy/resources%2Fscript.js HTTP/1.1" 200 165
127.0.0.1 - - [11/May/2017:07:59:43 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?experimental=false&should_run=yes&csp=%09%09%09script-src%20%20%20%20http%3A%2F%2F127.0.0.1%3A8000%20%20%09%09%20%20https%3A&q=/security/contentSecurityPolicy/resources%2Fscript.js HTTP/1.1" 200 165
127.0.0.1 - - [11/May/2017:07:59:43 -0700] "GET /security/contentSecurityPolicy/resources/echo-script-src.pl?experimental=false&should_run=yes&csp=script-src%20https%3A%20%20%08&q=/security/contentSecurityPolicy/resources%2Fscript.js HTTP/1.1" 500 755

Mergedinto: 720511
Status: Duplicate (was: Untriaged)

Sign in to add a comment