Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  closed
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:  fixed
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Florian Apolloner):

 > and there is no workaround until 3.2.1 is released, right?

 Setting a custom storage backend with the fix applied is one option. The
 other option is a custom Django package till 3.2.1 is released.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.2bd97604ea76dec7b8ddb5b0adb7095f%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  closed
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:  fixed
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Adam Hooper):

 Could Django please release a patch release that fixes this bug?

 Unless I'm misunderstanding, I've run into this:

 1. Upgrade to Django 3.2.
 2. Test. Everything passes.
 3. Deploy to production.
 4. Users experience 500 errors.

 In my case, I _happened_ to catch this when I deployed to staging. Pure
 luck.

 But in general, this crash affect tons of existing sites and there is no
 workaround until 3.2.1 is released, right?

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.912bbdbb26e918311b989d388355e696%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  closed
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:  fixed
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Mariusz Felisiak ):

 In [changeset:"539d005aa5fb496f0a648a2385465eca06c604e9" 539d005a]:
 {{{
 #!CommitTicketReference repository=""
 revision="539d005aa5fb496f0a648a2385465eca06c604e9"
 [3.2.x] Fixed #32643 -- Fixed decoding of messages in the pre-Django 3.2
 format.

 Thanks Jan Pieter Waagmeester for the report.

 Regression in 2d6179c819010f6a9d00835d5893c4593c0b85a0.

 Backport of 4511d1459810037b91faa5b506e4f75c77aa72be from main.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.55b785943d4c63ea3f14ccf5cdabd704%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  closed
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:  fixed
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Mariusz Felisiak ):

 * status:  assigned => closed
 * resolution:   => fixed


Comment:

 In [changeset:"4511d1459810037b91faa5b506e4f75c77aa72be" 4511d145]:
 {{{
 #!CommitTicketReference repository=""
 revision="4511d1459810037b91faa5b506e4f75c77aa72be"
 Fixed #32643 -- Fixed decoding of messages in the pre-Django 3.2 format.

 Thanks Jan Pieter Waagmeester for the report.

 Regression in 2d6179c819010f6a9d00835d5893c4593c0b85a0.
 }}}

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.b4c8ec94153c59eb85c2c32e01a5c521%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  assigned
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Mariusz Felisiak):

 * has_patch:  0 => 1
 * stage:  Accepted => Ready for checkin


Comment:

 [https://github.com/django/django/pull/14266 PR]

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.0c401632937930ba8de3823f56e3a98e%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  assigned
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:
 Keywords:   | Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Jan Pieter Waagmeester):

 Replying to [comment:7 Florian Apolloner]:
 > Hi Jan, I have attached a diff that should fix your issue. Do you think
 you could apply that single change to your Django codebase and retry?

 Works like expected with the patch applied, great!

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.bd8c56c4f4c61a3ef5f13bf4619b658b%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  Florian
  Waagmeester|  Apolloner
 Type:  Bug  |   Status:  assigned
Component:  contrib.messages |  Version:  3.2
 Severity:  Release blocker  |   Resolution:
 Keywords:   | Triage Stage:  Accepted
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Mariusz Felisiak):

 * owner:  nobody => Florian Apolloner
 * status:  new => assigned
 * severity:  Normal => Release blocker
 * stage:  Unreviewed => Accepted


Comment:

 Regression in 2d6179c819010f6a9d00835d5893c4593c0b85a0.
 #32191

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.72ab40992a78b4c2aa643fa534aaa029%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Florian Apolloner):

 Hi Jan, I have attached a diff that should fix your issue. Do you think
 you could apply that single change to your Django codebase and retry?

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.ce8714e4cb768ca0d6b4265f5de75e4a%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Florian Apolloner):

 * Attachment "32643.diff" added.


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.012203695c793bd8b56528c03d51fb4b%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Florian Apolloner):

 Thanks,  I think I understand what is going on. Out of pure luck we
 created test messages that properly decode from base64. They then fail
 json decoding and fall back to the old mechanism. I think we need to add
 `binascii.Error` to
 
https://github.com/django/django/commit/2d6179c819010f6a9d00835d5893c4593c0b85a0
 #diff-6c5e944e6869d04c50af2ee02dd85c621177547eb7771d11066f452788d483f4R185

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.0ef0657cb19f4e6d93d8c473798bc3e1%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Jan Pieter Waagmeester):

 I sent the contents of the cookie to security@

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.dc0e7f298890bbcec95a29558caa525b%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Florian Apolloner):

 What confuses me here is that according to the traceback the signature was
 valid and it then failed in
 
https://github.com/django/django/blob/b6475d7d7940f3ce575e0b0f2d83e517f899b4cf/django/core/signing.py#L195
 -- but if the signature was valid in the first place the data should have
 been base64 encoded. The contents of the cookie seem to suggest otherwise.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.f67b33b5b5e1fb64b73dcad5805e7ad1%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-

Comment (by Florian Apolloner):

 We might need the original cookie as seen by the browser. Can you send it
 to secur...@djangoproject.com (for the lack of a better "trusted" address,
 we will handle the data with care).

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.17a4f46b5b09975ae27c0ce05132c897%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Mariusz Felisiak):

 * cc: Florian Apolloner (added)


Comment:

 Jan thanks for this report, however I cannot reproduce this issue.
 Everything works when I will use your messages in
 
[https://github.com/django/django/blob/59552bea5790c97be0da0a6f16ccd0189857c7a7/tests/messages_tests/test_cookie.py#L182-L193
 messages_tests.test_cookie.CookieTests.test_legacy_encode_decode].

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/064.9dd5a28da6586e8ff290accb86503b66%40djangoproject.com.

Re: [Django] #32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2

[Django]

#32643: CookieStorage for contrib.messages crashes after upgrade to django 3.2
-+-
 Reporter:  Jan Pieter   |Owner:  nobody
  Waagmeester|
 Type:  Bug  |   Status:  new
Component:  contrib.messages |  Version:  3.2
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:
 |  Unreviewed
Has patch:  0|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Description changed by Jan Pieter Waagmeester:

Old description:

> After upgrading to django 3.2, a prevously stored cookie for
> contrib.messages crashes in
>
> https://github.com/django/django/blob/d6314c4c2ef647efe0d12450214fc5b4a4055290/django/contrib/messages/storage/cookie.py#L175
>
> Django Version: 3.2
> Python Version: 3.8.2
>
> {{{
> Traceback (most recent call last):
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/core/handlers/exception.py", line 47, in inner
> response = get_response(request)
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/utils/deprecation.py", line 119, in __call__
> response = self.process_response(request, response)
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/contrib/messages/middleware.py", line 23, in
> process_response
> unstored_messages = request._messages.update(response)
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/contrib/messages/storage/base.py", line 127, in update
> messages = self._loaded_messages + self._queued_messages
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/contrib/messages/storage/base.py", line 79, in
> _loaded_messages
> messages, all_retrieved = self._get()
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/contrib/messages/storage/fallback.py", line 25, in _get
> messages, all_retrieved = storage._get()
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/contrib/messages/storage/cookie.py", line 86, in _get
> messages = self._decode(data)
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/contrib/messages/storage/cookie.py", line 175, in _decode
> return self.signer.unsign_object(data, serializer=MessageSerializer)
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/core/signing.py", line 195, in unsign_object
> data = b64_decode(base64d)
>   File "/home/obs/virtualenv/lib/python3.8/site-
> packages/django/core/signing.py", line 68, in b64_decode
> return base64.urlsafe_b64decode(s + pad)
>   File "/usr/lib/python3.8/base64.py", line 133, in urlsafe_b64decode
> return b64decode(s)
>   File "/usr/lib/python3.8/base64.py", line 87, in b64decode
> return binascii.a2b_base64(s)
>
> Exception Type: Error at /user/login/
> Exception Value: Invalid base64-encoded string: number of data characters
> (369) cannot be 1 more than a multiple of 4
> }}}
>
> (redacted) contents of the 'messages' cookie:
> {{{
> '[["__json_message",0,25,"Successfully signed in as '
>  'ad...@example.org."],["__json_message",0,25,"Successfully '
>  'signed in as jieter."],["__json_message",0,25,"Ingelogd als '
>  'ad...@example.org."],["__json_message",0,25,"Ingelogd '
>  'als '
>  'ad...@example.org."],["__json_message",0,20,"Bevestigingsmail '
>  'verzonden naar t...@example.nl."],["__json_message",0,25,"Ingelogd '
>  'als '
>  't...@example.nl."]]:1lTkj1:j_3PlpYSKiqPTMAB6_p2Q00eE8j6k7n0Sg_-
> _IpXG7Y')
> }}}

New description:

 After upgrading to django 3.2, a previously stored cookie for
 contrib.messages crashes in

 
https://github.com/django/django/blob/d6314c4c2ef647efe0d12450214fc5b4a4055290/django/contrib/messages/storage/cookie.py#L175

 Django Version: 3.2
 Python Version: 3.8.2

 {{{
 Traceback (most recent call last):
   File "/home/obs/virtualenv/lib/python3.8/site-
 packages/django/core/handlers/exception.py", line 47, in inner
 response = get_response(request)
   File "/home/obs/virtualenv/lib/python3.8/site-
 packages/django/utils/deprecation.py", line 119, in __call__
 response = self.process_response(request, response)
   File "/home/obs/virtualenv/lib/python3.8/site-
 packages/django/contrib/messages/middleware.py", line 23, in
 process_response
 unstored_messages = request._messages.update(response)
   File "/home/obs/virtualenv/lib/python3.8/site-
 packages/django/contrib/messages/storage/base.py", line 127, in update
 messages = self._loaded_messages + self._queued_messages
   File "/home/obs/virtualenv/lib/python3.8/site-
 packages/django/contrib/messages/sto