Suspected csrf error in Django view using google protocol buffers

Question

Here is a link to the proto file.

Spent a long time trying to figure out the finer points of how the information was being encoded only to realise that if I commented out the HttpResponse line I still received the same internal server error message in my bitcoin-qt client when sending test deposits:

from django.views.decorators.csrf import csrf_exempt
from project import payments_pb2

@csrf_exempt
def protoresponse(request):
    x = payments_pb2

    xpo = x.Payment.FromString(request.body)

    xpa = x.PaymentACK()
    xpa.payment = xpo
    xpa.memo = 'success'

return HttpResponse(xpa.SerializeToString(), content_type="application/bitcoin-paymentack")

I can see nothing wrong with this code but the communication error remains, server error "POST /protoresponse/ HTTP/1.1" 500 58538.

I placed debug code into the script to check if variables were being set and it worked fine all the way down to xpa.memo = ''success' so it looks like an error is occurring in the HttpResponse() method. Either that or something is getting in the way of the response.

Suspect it has something to do with csrf, without the @csrf_exempt decorator I am presented with a "POST /protoresponse/ HTTP/1.1" 403 2282 error instead.

Any input would be greatly appreciated :)

Django has an error logging capabilities. https://docs.djangoproject.com/en/dev/topics/logging/ Error 500 means internal server error and this leaves a Python traceback for the debugging purposes. Please log the actual error to the file, so there is no need to try to guess what is wrong. How to include CSRF token in your requests is documented here https://docs.djangoproject.com/en/dev/ref/contrib/csrf/ — Mikko Ohtamaa, Jun 18 '14 at 06:50

score 0 · Answer 1 · edited May 23 '17 at 12:21

0

I don't know if there is a csrf error as well, but you do have one obvious bug here: you don't instantiate the protobuff object.

xpa = x.PaymentACK()   # note parens

There are other errors too: as I showed in my previous answer, xpa.payment is also supposed to be a protobuff, of type Payment, not the raw http body. I don't know why you changed it from that answer.

edited May 23 '17 at 12:21

Community

1
1

answered Jun 18 '14 at 07:29

Daniel Roseman

588,541
66
880
895

I have updated the code above to compensate for the errors, the bitcoin wiki gave the impression the `xpa.payment` was to be a serialized so I thought I could just feed it the `request.body`. I am still experiencing the before mentioned error though, I am going to learn to enable error logging and hopefully come back with more information :) – derrend Jun 18 '14 at 09:20
As Mike suggests, you should be logging the errors so we can see what's wrong. Maybe take the serialization out of the last line and set it to a variable which you can also log, to see what is going on. – Daniel Roseman Jun 18 '14 at 09:49
I still have not yet configured django for logging, in the mean time though I changed my script to write to a file for debugging like last time and there is indeed a problem with `xpa.SerializeToString()`, the script shows no output for this variable and exits with an error 500. Thank you for the suggestion :D Please let me know if you have any more :) – derrend Jun 18 '14 at 11:22
You're still not instantiating the PaymentACK as I stated in the answer above. – Daniel Roseman Jun 18 '14 at 11:25
Sorry but that is because if I do include the parens `()` then the error checking script stops and there is no output for `f.write('%s\n' % xpa)`. – derrend Jun 18 '14 at 11:37
*You need to see the errors*. This is all guessing in the dark here and completely pointless. Until you configure logging to find out what the actual errors are, we'll be going round and round with no solution. – Daniel Roseman Jun 18 '14 at 11:39
ok using the logger module I captured the error `CRITICAL:root:unbound method SerializeToString() must be called with PaymentACK instance as first argument (got nothing instead)` at line `xpa = xpa.SerializeToString()`, If I run it again with the patens at the end of PaymentACK then there is no error shown in the logs but it does break the script. I hope this is helpful :) – derrend Jun 18 '14 at 13:25
Update :) Using logger I have been given the error below: `xpa.payment = xpo`, `AttributeError: Assignment not allowed to composite field "payment" in protocol message object.` Please do let me know if this is helping :) – derrend Jun 19 '14 at 00:40

derrend · Accepted Answer · 2014-06-19T04:08:12.330

I managed to get it working with the ParseFromString() method like so:

from django.views.decorators.csrf import csrf_exempt
from project import payments_pb2

@csrf_exempt
def protoresponse(request):
    x = payments_pb2

    xpa = x.PaymentACK()
    xpa.payment.ParseFromString(request.body)
    xpa.memo = 'success'

return HttpResponse(xpa.SerializeToString(), content_type="application/bitcoin-paymentack")

The problem was that I was trying to decode the information from the returned 'Payment' object into a newly instantiated 'Payment' object and then encode that information into 'PaymentACK.payment' (they are also quite similar 'Payment/payment' which caused some confusion along the way as well).

And it would have worked perfectly, I could have used:

x = payments_pb2

xpo = x.Payment.FromString(request.body)

xpa = x.PaymentACK()
xpa.payment.ParseFromString(xpo.SerializeToString())
xpa.memo = 'success'

but it seemed like extra work for no reason.

@Daniel I know you told me not to use request.body but I'm planning to host this app on heroku and they charge by the cpu usage as I understand it so I'm trying to cut out as much data manipulation as possible :) Thank you very much for the help (on both occasions), it was greatly appreciated and I understand protobuffs much better now :)

Suspected csrf error in Django view using google protocol buffers

2 Answers2