Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@Cimihan123) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

I'm trying to run this on a Windows 10 Professional platform with Docker Desktop 20.10.16 and use a shared directory.

I'm able to mount the directory with:

docker run -p 5000:5000 -v j:\sar2html:/sar2html/data -d -h sar2html.localdomain cemtan/sar2html:4.0.0

The db files get written in the db directory. When I upload a tar.gz file, this also gets uploaded to the tmp directory. It appears to be unpacked correctly.

At that point, the browser returns the 500 Internal Server error.

Is there a place where I can look to find any error logs?

The platform works great when I don't use a shared directory.

Description:
I use the provided sar2ascii tool to generate a tar file. When i attempt to upload that data into sar2html either via the BUI or using curl i receive a 500 - internal server error in response.

Running the app interactively i can see it generates the following error message:

[2021-11-19 14:13:01,876] ERROR in app: Exception on / [POST]
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 2073, in wsgi_app
response = self.full_dispatch_request()
File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1518, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1516, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1502, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args)
File "sar2html.py", line 400, in uploadFiles
updateThread = AppContextThread(target=updateDb(hostList, app.config['UPLOAD_FOLDER']))
File "sar2html.py", line 103, in updateDb
s2df.columns = s2col
File "/usr/local/lib64/python3.6/site-packages/pandas/core/generic.py", line 5154, in setattr
return object.setattr(self, name, value)
File "pandas/_libs/properties.pyx", line 66, in pandas._libs.properties.AxisProperty.set
File "/usr/local/lib64/python3.6/site-packages/pandas/core/generic.py", line 564, in _set_axis
self._mgr.set_axis(axis, labels)
File "/usr/local/lib64/python3.6/site-packages/pandas/core/internals/managers.py", line 227, in set_axis
f"Length mismatch: Expected axis has {old_len} elements, new "
ValueError: Length mismatch: Expected axis has 5 elements, new values have 6 elements
[pid: 25916|app: 0|req: 1/4] 172.17.65.101 () {48 vars in 1004 bytes} [Fri Nov 19 14:12:55 2021] POST / => generated 290 bytes in 6060 msecs (HTTP/1.1 500) 2 headers in 99 bytes (93 switches on core 0)

Steps to reproduce the behavior:
I followed the git clone, install requirements, installation process. Everything looked to install fine, the app starts fine and i can browse the app without error.

Expected behavior
Uploaded data is ingested into the app for viewing through the BUI

Screenshots
N/A just a standard 500 internal server error

Desktop (please complete the following information):

• OS: Win10
• Browser: Chrome
• Version: 95.0.4638.69 (Official Build) (64-bit)

Additional context
Running on Oracle Linux 7.9

The error i receive from curl looks like this:

$ curl -F "file=@/tmp/sar2html-<MY_HOSTNAME>-2111191346.tar.gz" localhost:5000 -v

• About to connect() to localhost port 5000 (#0)
• Trying 127.0.0.1...
• Connected to localhost (127.0.0.1) port 5000 (#0)

POST / HTTP/1.1
User-Agent: curl/7.29.0
Host: localhost:5000
Accept: /
Content-Length: 1438783
Expect: 100-continue
Content-Type: multipart/form-data; boundary=----------------------------66a41b0862f6

• Done waiting for 100-continue
  < HTTP/1.1 500 INTERNAL SERVER ERROR
  < Content-Type: text/html; charset=utf-8
  < Content-Length: 290
• HTTP error before end of send, stop sending
  <

<title>500 Internal Server Error</title>

Internal Server Error

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

* Closing connection 0

Hi,
When I run the docker image with below command (Ubuntu), I'm getting the error:
docker run -p 80:80 cemtan/sar2html:v3.2.1

Error:
Status: Downloaded newer image for cemtan/sar2html:v3.2.1
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the 'ServerName' directive globally to suppress this message
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the 'ServerName' directive globally to suppress this message
[Mon Feb 24 17:45:03.558021 2020] [mpm_prefork:notice] [pid 1] AH00163: Apache/2.4.25 (Debian) PHP/7.1.20 configured -- resuming normal operations
[Mon Feb 24 17:45:03.558093 2020] [core:notice] [pid 1] AH00094: Command line: 'apache2 -D FOREGROUND'
[Mon Feb 24 17:45:11.489179 2020] [mpm_prefork:notice] [pid 1] AH00170: caught SIGWINCH, shutting down gracefully