From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <d.csapak@proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 849B69073 for <pve-devel@lists.proxmox.com>; Wed, 8 Mar 2023 07:34:11 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 69EFF1C347 for <pve-devel@lists.proxmox.com>; Wed, 8 Mar 2023 07:34:11 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for <pve-devel@lists.proxmox.com>; Wed, 8 Mar 2023 07:34:09 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id A1BB442135 for <pve-devel@lists.proxmox.com>; Wed, 8 Mar 2023 07:34:09 +0100 (CET) Message-ID: <8c8e6645-50a2-4d1a-87aa-32da027ab16a@proxmox.com> Date: Wed, 8 Mar 2023 07:34:08 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.8.0 Content-Language: en-US To: Thomas Lamprecht <t.lamprecht@proxmox.com>, Proxmox VE development discussion <pve-devel@lists.proxmox.com>, Friedrich Weber <f.weber@proxmox.com> References: <20230306140314.1150179-1-f.weber@proxmox.com> <9e245a3d-98ea-8ea0-e953-d1dbc0496393@proxmox.com> From: Dominik Csapak <d.csapak@proxmox.com> In-Reply-To: <9e245a3d-98ea-8ea0-e953-d1dbc0496393@proxmox.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.061 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment NICE_REPLY_A -0.001 Looks like a legit reply (A) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [data.store] Subject: Re: [pve-devel] [PATCH widget-toolkit] fix #4421: ui: guard setProxy against races of slow vs fast requests X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> List-Post: <mailto:pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Wed, 08 Mar 2023 06:34:11 -0000 On 3/7/23 19:49, Thomas Lamprecht wrote: > Am 06/03/2023 um 15:03 schrieb Friedrich Weber: >> Some UI components use `Ext.data.Store.setProxy` to change their >> associated API endpoint URL in reaction to user input. One example is >> `BackupView`, which calls `setProxy` when the user switches from >> listing backups on storage A to listing backups on storage B. However, >> if A is slow, the UI may receive the response for A *after* the >> response for B. It will then display the contents of A as if they were >> the contents of B, resulting in a UI inconsistency. >> >> The reason is that `Ext.data.Store` still processes the slow response >> for A, even though it is obsolete. This patch overrides the >> responsible callback of `Ext.data.Store` to only process responses >> belonging to the currently active proxy object. This should rule out >> similar race conditions in all components that use the `setProxy` API. >> In the above example, the patch results in the response for A being >> ignored. >> >> Ignored responses are logged to the browser console. >> >> Note that this patch only concerns components that use `setProxy` for >> changing API endpoints. Other components (e.g. those using >> `proxy.setURL` for the same purpose) may be open to similar race >> conditions. >> >> Signed-off-by: Friedrich Weber <f.weber@proxmox.com> >> --- >> The original report only concerns the backup view [1], where the race >> condition is easy to trigger. While ruling out this particular race is >> simple, I thought it would be worthwhile to rule out race condition of >> this category for all components. Hence this patch. However, most of the >> other races are much harder to trigger, so it may be questionable >> whether a general fix is needed. So if wanted, I can alternatively >> submit a patch that only fixes the backup view. > > IMO a general fix/future proofing can be OK, so besides a small nit inline: > LGTM, but did not checked/tested this too closely - @Dominik, what do you > think on this? > This change is non-intrusive enough that it's OK, since it fixes the reported issue and potentially some more. When we're only fixing the one reported place, i guess sooner or later someone else reports another instance of this, and by then we probably forgot that we fixed it already once ;) Really fixing all points where something like that can happen is not easy since most of them are using Proxmox.Utils.API2Request instead of a store, or as Friedrich already wrote, setting the URL of the proxy manually, so this seems to be good middle ground for now.