后端 Flask 應用中的 PEPPER 拋出 KeyError: 'PEPPER'

Question

我們正在做一個小型后端項目，開發后端的伙伴不再與我們合作。 我們現在被困住了，我知道這與安全有關嗎？ 嘗試在 Heroku 上托管后端，我們得到以下錯誤日志。

File "/app/cs673backend/__init__.py", line 9, in <module>
2022-04-20T14:27:01.428446+00:00 app[web.1]: from .api import start_api
2022-04-20T14:27:01.428446+00:00 app[web.1]: File "/app/cs673backend/api/__init__.py", line 1, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: from .authentication  import start as start_authen
2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/cs673backend/api/authentication.py", line 10, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: PEPPER = environ["PEPPER"].encode("utf-8")
2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/os.py", line 679, in __getitem__
2022-04-20T14:27:01.428447+00:00 app[web.1]: raise KeyError(key) from None
2022-04-20T14:27:01.428448+00:00 app[web.1]: KeyError: 'PEPPER'
2022-04-20T14:27:01.428601+00:00 app[web.1]: [2022-04-20 14:27:01 +0000] [10] [INFO] Worker exiting (pid: 10)
2022-04-20T14:27:01.526847+00:00 app[web.1]: Traceback (most recent call last):
2022-04-20T14:27:01.526854+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 209, in run
2022-04-20T14:27:01.527040+00:00 app[web.1]: self.sleep()
2022-04-20T14:27:01.527042+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 357, in sleep
2022-04-20T14:27:01.527156+00:00 app[web.1]: ready = select.select([self.PIPE[0]], [], [], 1.0)
2022-04-20T14:27:01.527157+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 242, in handle_chld
2022-04-20T14:27:01.527239+00:00 app[web.1]: self.reap_workers()
2022-04-20T14:27:01.527240+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 525, in reap_workers
2022-04-20T14:27:01.527354+00:00 app[web.1]: raise HaltServer(reason, self.WORKER_BOOT_ERROR)
2022-04-20T14:27:01.527399+00:00 app[web.1]: gunicorn.errors.HaltServer: <HaltServer 'Worker failed to boot.' 3>
2022-04-20T14:27:01.527400+00:00 app[web.1]:
2022-04-20T14:27:01.527401+00:00 app[web.1]: During handling of the above exception, another exception occurred:
2022-04-20T14:27:01.527401+00:00 app[web.1]:
2022-04-20T14:27:01.527402+00:00 app[web.1]: Traceback (most recent call last):
2022-04-20T14:27:01.527410+00:00 app[web.1]: File "/app/.heroku/python/bin/gunicorn", line 8, in <module>
2022-04-20T14:27:01.527463+00:00 app[web.1]: sys.exit(run())
2022-04-20T14:27:01.527471+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/app/wsgiapp.py", line 67, in run
2022-04-20T14:27:01.527535+00:00 app[web.1]: WSGIApplication("%(prog)s [OPTIONS] [APP_MODULE]").run()
2022-04-20T14:27:01.527542+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/app/base.py", line 231, in run
2022-04-20T14:27:01.527621+00:00 app[web.1]: super().run()
2022-04-20T14:27:01.527622+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/app/base.py", line 72, in run
2022-04-20T14:27:01.527681+00:00 app[web.1]: Arbiter(self).run()
2022-04-20T14:27:01.527682+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 229, in run
2022-04-20T14:27:01.527757+00:00 app[web.1]: self.halt(reason=inst.reason, exit_status=inst.exit_status)
2022-04-20T14:27:01.527759+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 342, in halt
2022-04-20T14:27:01.527851+00:00 app[web.1]: self.stop()
2022-04-20T14:27:01.527852+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 393, in stop
2022-04-20T14:27:01.527949+00:00 app[web.1]: time.sleep(0.1)
2022-04-20T14:27:01.527950+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 242, in handle_chld
2022-04-20T14:27:01.528026+00:00 app[web.1]: self.reap_workers()
2022-04-20T14:27:01.528027+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/site-packages/gunicorn/arbiter.py", line 525, in reap_workers
2022-04-20T14:27:01.528141+00:00 app[web.1]: raise HaltServer(reason, self.WORKER_BOOT_ERROR)
2022-04-20T14:27:01.528167+00:00 app[web.1]: gunicorn.errors.HaltServer: <HaltServer 'Worker failed to boot.' 3>
2022-04-20T14:27:01.691720+00:00 heroku[web.1]: Process exited with status 1
2022-04-20T14:27:01.754717+00:00 heroku[web.1]: State changed from up to crashed
2022-04-20T14:27:27.811162+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/" host=host-py.herokuapp.com request_id=eb24802e-f317-4c41-9f38-8a52371ac736 fwd="117.98.153.124" dyno= connect= service= status=503 bytes= protocol=https
2022-04-20T14:27:28.408186+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/favicon.ico" host=host-py.herokuapp.com request_id=f1532d3b-8c0a-411e-8133-8193e889595a fwd="117.98.153.124" dyno= connect= service= status=503 bytes= protocol=https

Answer 1

堆棧跟蹤告訴所有：

2022-04-20T14:27:01.428446+00:00 app[web.1]: from .api import start_api
2022-04-20T14:27:01.428446+00:00 app[web.1]: File "/app/cs673backend/api/__init__.py", line 1, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: from .  import start as start_authen
2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/cs673backend/api/authentication.py", line 10, in <module>
2022-04-20T14:27:01.428447+00:00 app[web.1]: PEPPER = environ["PEPPER"].encode("utf-8")

在這里，似乎在導入api時，可能在處理__init__.py期間，導入了authentication ，並且在處理它時，

PEPPER = environ["PEPPER"].encode("utf-8")

遇到了。 很遺憾，

2022-04-20T14:27:01.428447+00:00 app[web.1]: File "/app/.heroku/python/lib/python3.10/os.py", line 679, in __getitem__
2022-04-20T14:27:01.428447+00:00 app[web.1]: raise KeyError(key) from None
2022-04-20T14:27:01.428448+00:00 app[web.1]: KeyError: 'PEPPER'

該環境變量未設置。 獲取該設置（請參閱 Heroku 文檔）並重試。