Scan freezes on File permissions. Guzzle Error [#3426944]

Problem/Motivation

Hey all... upgraded from 2.0 to 3.0. On first security scan, it freezes at file permissions (4 of 18), and I get this guzzle error.

GuzzleHttp\Exception\ClientException: Client error: `GET https://sitename.com` resulted in a `401 Unauthorized` response in GuzzleHttp\Exception\RequestException::create() (line 113 of /home/public_html/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php).

Tried reinstalling, a new composer require with-dependencies, etc. No help. Any suggestions? Am i missing something simple?

Issue fork security_review-3426944

Show commands

Start within a Git clone of the project using the version control instructions.

Add & fetch this issue fork’s repository

Or, if you do not have SSH keys set up on git.drupalcode.org:

Add & fetch this issue fork’s repository

3426944-scan-freezes-on changes, plain diff MR !64
Check out this branch for the first time

Check out existing branch, if you already have it locally

About issue forks

Comments

Comment #1

11 March 2024 at 02:01

chucksimply created an issue. See original summary.

Comment #2

eelkeblok

he/him

Dutch

Netherlands 🇳🇱

commented 11 March 2024 at 10:58

Presumably, sitename.com is the site you are scanning? Is there anything in the logs? I'd be especially interested in the stack trace. I'm guessing this might in fact be the next scan, because the file permissions do not involve an HTTP request (other than that from your browser to run the batch iteration). Just not sure which one that would be. Maybe the Headers one.

Comment #3

smustgrave commented 11 March 2024 at 23:52

Wonder if it's the headers check.

Comment #4

smustgrave commented 12 March 2024 at 15:51

Status:

Active

» Postponed (maintainer needs more info)

@chucksimply if you disable that one check does it run now?

Also know of any firewall that may be blocking your site from hitting itself to check headers?

Comment #5

eelkeblok

he/him

Dutch

Netherlands 🇳🇱

commented 14 March 2024 at 09:44

I was thinking the same thing. I had a peek at the code in the Headers scan and I believe it should pass an option to Guzzle to not throw exceptions for "error" codes (it's in the documentation, don't remember the details). Or, alternatively, catch any exceptions Guzzle might throw (but IIRC that can be a little tricky; you'd need to catch a base exception that all other exceptions derive from, for our purposes).