Skip to content

Internal Server error "no namespace" on paths /v1/auth/token/lookup, /v1/auth/token/renew, /v1/auth/token/revoke, /v1/auth/token/revoke-orphan when token has random Unicode chars #13273

@ludovicianul

Description

@ludovicianul

Describe the bug
Making a POST at any of the 4 URLs with token having the supplied value in the JSON examples, results in 500 - Internal Server Error

To Reproduce
Steps to reproduce the behavior:

  1. Run curl with the payload supplied in the json files.

Tests.zip

Same steps to reproduce for all paths.

This was discovered while running a fuzzing tool I wrote for OpenAPI specs: https://github.com/Endava/cats. You can replay all the tests using:
./cats.jar replay --tests="Test232.json,Test644.json,Test1046.json,Test1280.json"

Expected behavior
A 400 response.

Environment:

  • Vault Server Version (retrieve with vault status): 1.9.0
  • Vault CLI Version (retrieve with vault version): Vault v1.9.0
  • Server Operating System/Architecture: macOS Monterey 12.0.1

Probably same root cause as: #13274

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions