Merge pull request #624 from Brikaa/fix-job-cleanup-evasion-vulnerability

Fix job cleanup evasion vulnerability, improve job execution error handling

api/src/api/v2.js

@@ -210,20 +210,27 @@ router.ws('/connect', async (ws, req) => {
                     if (job === null) {
                         job = await get_job(msg);
 
-                        await job.prime();
+                        try {
+                            await job.prime();
 
-                        ws.send(
+                            ws.send(
-                            JSON.stringify({
+                                JSON.stringify({
-                                type: 'runtime',
+                                    type: 'runtime',
-                                language: job.runtime.language,
+                                    language: job.runtime.language,
-                                version: job.runtime.version.raw,
+                                    version: job.runtime.version.raw,
-                            })
+                                })
-                        );
+                            );
 
-                        await job.execute(event_bus);
+                            await job.execute(event_bus);
-                        await job.cleanup();
+                        } catch (error) {
-
+                            logger.error(
-                        ws.close(4999, 'Job Completed');
+                                `Error cleaning up job: ${job.uuid}:\n${error}`
+                            );
+                            throw error;
+                        } finally {
+                            await job.cleanup();
+                        }
+                        ws.close(4999, 'Job Completed'); // Will not execute if an error is thrown above
                     } else {
                         ws.close(4000, 'Already Initialized');
                     }
@@ -265,9 +272,13 @@ router.ws('/connect', async (ws, req) => {
 });
 
 router.post('/execute', async (req, res) => {
+    let job;
+    try {
+        job = await get_job(req.body);
+    } catch (error) {
+        return res.status(400).json(error);
+    }
     try {
-        const job = await get_job(req.body);
-
         await job.prime();
 
         let result = await job.execute();
@@ -276,11 +287,17 @@ router.post('/execute', async (req, res) => {
             result.run = result.compile;
         }
 
-        await job.cleanup();
-
         return res.status(200).send(result);
     } catch (error) {
-        return res.status(400).json(error);
+        logger.error(`Error executing job: ${job.uuid}:\n${error}`);
+        return res.status(500).send();
+    } finally {
+        try {
+            await job.cleanup(); // This gets executed before the returns in try/catch
+        } catch (error) {
+            logger.error(`Error cleaning up job: ${job.uuid}:\n${error}`);
+            return res.status(500).send(); // On error, this replaces the return in the outer try-catch
+        }
     }
 });
 

api/src/index.js

@@ -35,7 +35,10 @@ expressWs(app);
             }
         }
     });
-    fss.chmodSync(path.join(config.data_directory, globals.data_directories.jobs), 0o711)
+    fss.chmodSync(
+        path.join(config.data_directory, globals.data_directories.jobs),
+        0o711
+    );
 
     logger.info('Loading packages');
     const pkgdir = path.join(
@@ -92,7 +95,12 @@ expressWs(app);
     logger.debug('Calling app.listen');
     const [address, port] = config.bind_address.split(':');
 
-    app.listen(port, address, () => {
+    const server = app.listen(port, address, () => {
         logger.info('API server started on', config.bind_address);
     });
+
+    process.on('SIGTERM', () => {
+        server.close();
+        process.exit(0)
+    });
 })();

repo/Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && apt-get install -y unzip autoconf build-essential libssl-d
         rm -rf /var/lib/apt/lists/* && \
         update-alternatives --install /usr/bin/python python /usr/bin/python3.7 2
 
-ADD entrypoint.sh mkindex.sh /
+ADD entrypoint.sh mkindex.sh serve.py /
 
 ENTRYPOINT ["bash","/entrypoint.sh"]
 CMD ["--no-build"]

repo/entrypoint.sh

@@ -27,7 +27,7 @@ do
             echo "Done with package $pkg"
         elif [[ $CI -eq 1 ]]; then
             echo "Commit SHA: $pkg"
-            
+
             cd ..
             echo "Changed files:"
             git diff --name-only $pkg^1 $pkg
@@ -52,8 +52,9 @@ echo "Index created"
 
 if [[ $SERVER -eq 1 ]]; then
     echo "Starting index server.."
-    python3 -m http.server
+    # We want the child process to replace the shell to handle signals
+    exec python3 /serve.py
 else
     echo "Skipping starting index server"
 fi
-exit 0
+exit 0

repo/serve.py

@@ -0,0 +1,18 @@
+import signal
+import sys
+import http.server
+import socketserver
+
+PORT = 8000
+
+Handler = http.server.SimpleHTTPRequestHandler
+
+
+def signal_handler(sig, frame):
+    sys.exit(0)
+
+signal.signal(signal.SIGTERM, signal_handler)
+
+with socketserver.TCPServer(("", PORT), Handler) as httpd:
+    print("serving at port", PORT)
+    httpd.serve_forever()