[Gmod-gbrowse] GBrowse 2.48 on Mac OS X Yosemite

Discussion:

[Gmod-gbrowse] GBrowse 2.48 on Mac OS X Yosemite - tests fail

Vladimir Gritsenko

2015-03-09 17:10:02 UTC

Hello all,

I realize that 2.48 is 3 years old, but the production environment I need to patch is 2.48, so here I am.

The full error log is here: http://pastebin.com/sbFKycHi <http://pastebin.com/sbFKycHi> , but the gist of is that there are a lot of error messages that look like this:

http://localhost:57649; search failed: 500 Can't connect to localhost:57649 (Connection refused) at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/RegionSearch.pm line 563.

Thanks!

Timothy Parnell

2015-03-09 18:08:26 UTC

Permalink

Hi Vladimir,
I have not loaded GBrowse on Yosemite. Our lab’s Mac server is still on 10.9, so I don’t have any direct experience, unfortunately. These are just my opinions and best guesses.

Looking at your errors, the first reported is a CGI error.

CGI::param called in list context from package Bio::Graphics::Browser2::Render line 2319, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /Library/Perl/5.18/CGI.pm line 437.

I suspect CGI is failing, leading to db connection errors later in the log. The error is complaining about how CGI is being called, which makes me suspect a change in the API. Yosemite comes with Perl 5.18 and includes a newer version of CGI, which is probably why you’re seeing this error.

The Perl CGI module is in an interesting state. It looks like it’s been retired from the current Perl core. It's ownership has changed hands a few times since Lincoln Stein (who also wrote GBrowse) developed it over a decade ago. They’re recommending moving to newer modules as CGI is quickly becoming out-of-date and insecure.

Your best solution would be to downgrade your version of Perl and don’t use the system Perl. Use perlbrew to install and maintain separate versions of Perl; it’s the easiest way. Since you insist on using a very old version of GBrowse, I would look at those machines and install the same version of Perl that you are using on those (5.10? 5.12?).

Good luck.
Tim

On Mar 9, 2015, at 11:10 AM, Vladimir Gritsenko <***@gmail.com<mailto:***@gmail.com>> wrote:

Hello all,

I realize that 2.48 is 3 years old, but the production environment I need to patch is 2.48, so here I am.

The full error log is here: http://pastebin.com/sbFKycHi , but the gist of is that there are a lot of error messages that look like this:

http://localhost:57649<http://localhost:57649/>; search failed: 500 Can't connect to localhost:57649 (Connection refused) at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/RegionSearch.pm line 563.

Thanks!
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/_______________________________________________
Gmod-gbrowse mailing list
Gmod-***@lists.sourceforge.net<mailto:Gmod-***@lists.sourceforge.net>
https://lists.sourceforge.net/lists/listinfo/gmod-gbrowse

Scott Cain

2015-03-09 19:01:32 UTC

Permalink

Thanks Tim,

Just to add to that: I suspect that GBrowse 2.54 (the most recent release)
would likely suffer from the same issues.

Scott

On Mon, Mar 9, 2015 at 2:08 PM, Timothy Parnell <

Post by Timothy Parnell
Hi Vladimir,
I have not loaded GBrowse on Yosemite. Our labâs Mac server is still on
10.9, so I donât have any direct experience, unfortunately. These are just
my opinions and best guesses.
Looking at your errors, the first reported is a CGI error.
CGI::param called in list context from package
Bio::Graphics::Browser2::Render line 2319, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a
single named parameter" at /Library/Perl/5.18/CGI.pm line 437.
I suspect CGI is failing, leading to db connection errors later in the
log. The error is complaining about how CGI is being called, which makes me
suspect a change in the API. Yosemite comes with Perl 5.18 and includes a
newer version of CGI, which is probably why youâre seeing this error.
The Perl CGI module is in an interesting state. It looks like itâs been
retired from the current Perl core. It's ownership has changed hands a few
times since Lincoln Stein (who also wrote GBrowse) developed it over a
decade ago. Theyâre recommending moving to newer modules as CGI is quickly
becoming out-of-date and insecure.
Your best solution would be to downgrade your version of Perl and donât
use the system Perl. Use perlbrew to install and maintain separate versions
of Perl; itâs the easiest way. Since you insist on using a very old version
of GBrowse, I would look at those machines and install the same version of
Perl that you are using on those (5.10? 5.12?).
Good luck.
Tim
On Mar 9, 2015, at 11:10 AM, Vladimir Gritsenko <
Hello all,
I realize that 2.48 is 3 years old, but the production environment I need
to patch is 2.48, so here I am.
The full error log is here: http://pastebin.com/sbFKycHi , but the gist
http://localhost:57649<http://localhost:57649/>; search failed: 500 Can't
connect to localhost:57649 (Connection refused) at
/Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/RegionSearch.pm
line 563.
Thanks!
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now.
http://goparallel.sourceforge.net/_______________________________________________
Gmod-gbrowse mailing list
https://lists.sourceforge.net/lists/listinfo/gmod-gbrowse
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Gmod-gbrowse mailing list
https://lists.sourceforge.net/lists/listinfo/gmod-gbrowse

--
------------------------------------------------------------------------
Scott Cain, Ph. D. scott at scottcain dot
net
GMOD Coordinator (http://gmod.org/) 216-392-3087
Ontario Institute for Cancer Research

Vladimir Gritsenko

2015-03-11 13:50:35 UTC

Permalink

Hi Timothy,

The target production environment runs Perl 5.14. I tried both 5.14 and 5.12, and both are failing at the same places. However, the CGI module version is still 4.13, even in Perl 5.12. What is your CGI version?

Post by Timothy Parnell
Hi Vladimir,
I have not loaded GBrowse on Yosemite. Our lab’s Mac server is still on 10.9, so I don’t have any direct experience, unfortunately. These are just my opinions and best guesses.
Looking at your errors, the first reported is a CGI error.
CGI::param called in list context from package Bio::Graphics::Browser2::Render line 2319, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /Library/Perl/5.18/CGI.pm line 437.
I suspect CGI is failing, leading to db connection errors later in the log. The error is complaining about how CGI is being called, which makes me suspect a change in the API. Yosemite comes with Perl 5.18 and includes a newer version of CGI, which is probably why you’re seeing this error.
The Perl CGI module is in an interesting state. It looks like it’s been retired from the current Perl core. It's ownership has changed hands a few times since Lincoln Stein (who also wrote GBrowse) developed it over a decade ago. They’re recommending moving to newer modules as CGI is quickly becoming out-of-date and insecure.
Your best solution would be to downgrade your version of Perl and don’t use the system Perl. Use perlbrew to install and maintain separate versions of Perl; it’s the easiest way. Since you insist on using a very old version of GBrowse, I would look at those machines and install the same version of Perl that you are using on those (5.10? 5.12?).
Good luck.
Tim
Hello all,
I realize that 2.48 is 3 years old, but the production environment I need to patch is 2.48, so here I am.
http://localhost:57649<http://localhost:57649/>; search failed: 500 Can't connect to localhost:57649 (Connection refused) at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/RegionSearch.pm line 563.
Thanks!
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/_______________________________________________
Gmod-gbrowse mailing list
https://lists.sourceforge.net/lists/listinfo/gmod-gbrowse

Vladimir Gritsenko

2015-03-11 14:05:55 UTC

Permalink

I downgraded CGI to 3.43 (there appeared to be errors during testing, so I forced it). The CGI warnings are gone, but the original errors are still there:

t/03.render.t ............. 1/150 Can't call method "FETCH" without a package or object reference at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/Render/Slave.pm line 551.
http://localhost:57029; search failed: 500 Server closed connection without sending any data back at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/RegionSearch.pm line 563.

I’ll take a closer look at the test scripts later, see if I can figure it out. Meanwhile, what is Slave.pm? I saw a reference to ‘gbrowse-slave’ in the configuration, but don’t know what it is. Are they somehow connected?

Post by Vladimir Gritsenko
Hi Timothy,
The target production environment runs Perl 5.14. I tried both 5.14 and 5.12, and both are failing at the same places. However, the CGI module version is still 4.13, even in Perl 5.12. What is your CGI version?

Fields, Christopher J

2015-03-11 15:12:27 UTC

Permalink

Re: Slave: my memories fuzzy on this, but might be something related to the ‘renderfarm’ stuff?

My guess is this simply needs updated to deal with the changes in the CGI.pm API. But really things should be moved to PSGI or similar, and I don’t see anyone taking that task on unfortunately.

chris

Post by Vladimir Gritsenko
t/03.render.t ............. 1/150 Can't call method "FETCH" without a package or object reference at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/Render/Slave.pm line 551.
http://localhost:57029; search failed: 500 Server closed connection without sending any data back at /Users/bermanlab/dev/GBrowse/t/../lib/Bio/Graphics/Browser2/RegionSearch.pm line 563.
I’ll take a closer look at the test scripts later, see if I can figure it out. Meanwhile, what is Slave.pm? I saw a reference to ‘gbrowse-slave’ in the configuration, but don’t know what it is. Are they somehow connected?

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Gmod-gbrowse mailing list
https://lists.sourceforge.net/lists/listinfo/gmod-gbrowse

Vladimir Gritsenko

2015-03-12 17:15:56 UTC

Permalink

Found it.

HTTP/Request/Common.pm:85-86:

# HTML/4.01 says that line breaks are represented as "CR LF" pairs (i.e., `%0D%0A’)
$content =~ s/(?<!%0D)%0A/%0D%0A/g if defined($content);

Common.m changes the contents of a POST request sent by GBrowse from RegionSearch.pm:539. One of the items it changes is the frozen ‘env’ parameter (RegionSearch.pm:544). It is later thawed incorrectly, and then throws the weird error about the FETCH method.

The HTTP request code thinks that the content type is application/x-www-form-urlencoded. I see two options:
1) The bug is in the HTTP request code - it should not change the contents of the request.
2) The bug is in GBrowse - it should specify an explicit content type.

And the final question:
3) Unless nfreeze behaves differently on Mac (or maybe some other GBrowse code does), this isn’t platform-dependent code. Surely someone must have had an issue with this at some point. But I think that this error should actually be quite common. How do (did) the tests pass?

Vladimir Gritsenko

2015-03-12 17:30:53 UTC

Permalink

OK, I see that Prof. Stein fixed this exact error in 1c288b6. Case solved!

Post by Vladimir Gritsenko
Found it.
# HTML/4.01 says that line breaks are represented as "CR LF" pairs (i.e., `%0D%0A’)
$content =~ s/(?<!%0D)%0A/%0D%0A/g if defined($content);
Common.m changes the contents of a POST request sent by GBrowse from RegionSearch.pm:539. One of the items it changes is the frozen ‘env’ parameter (RegionSearch.pm:544). It is later thawed incorrectly, and then throws the weird error about the FETCH method.
1) The bug is in the HTTP request code - it should not change the contents of the request.
2) The bug is in GBrowse - it should specify an explicit content type.
3) Unless nfreeze behaves differently on Mac (or maybe some other GBrowse code does), this isn’t platform-dependent code. Surely someone must have had an issue with this at some point. But I think that this error should actually be quite common. How do (did) the tests pass?