Default routes mappings for format, edit and new are present

[Stuart McLaren]

This invalid call:

$ curl -H "x-auth-token: `cat ~/token`" http://localhost:9292/v1/images/detail.xxx

Returns 200 (rather than 404) and also creates a file in the cache area:

$ ls -l /opt/stack/data/glance/cache/detail.xxx
-rw-r----- 1 ubuntu ubuntu 1513 May 30 14:00 /opt/stack/data/glance/cache/detail.xxx

[Stuart McLaren (stuart-mclaren)]

This seems to be generic -- we've confirmed that cinder also treats non-valid urls as valid.

[Duncan Thomas (duncan-thomas)]

Cinder example (subtly redacted):

$ curl -i https://region-b.geo-1.block.hpcloudsvc.com/v1/123456/volumes/detail.xxx -X GET -H "X-Auth-Project-Id: <email address hidden>" -H "User-Agent: python-cinderclient" -H "Accept: application/json" -H "X-Auth-Token: HPAuth10_abcdef1234567890"
HTTP/1.1 200 OK
Content-Length: 340
Content-Type: application/json
Date: Thu, 30 May 2013 16:26:51 GMT
X-Compute-Request-Id: req-f11111b-39e9-4a2d-ab37-4d98591c4b64

{"volumes": [{"status": "available", "display_name": null, "attachments": [], "availability_zone": "az1", "bootable": "false", "created_at": "2013-05-16T13:48:11.000000", "display_description": null, "volume_type": "None", "snapshot_id": null, "source_volid": null, "metadata": {}, "id": "34a9d0cd-a74c-4b52-8067-db1234c0590f", "size": 1}]}

[Stuart McLaren (stuart-mclaren)]

Printing out the v1 route mapper, it looks like this:

                            POST /images.:(format)
                            POST /images
formatted_detail_images GET /images/detail.:(format)
detail_images GET /images/detail
formatted_images GET /images.:(format)
images GET /images
formatted_new_image GET /images/new.:(format)
new_image GET /images/new
                            PUT /images/:(id).:(format)
                            PUT /images/:(id)
                            DELETE /images/:(id).:(format)
                            DELETE /images/:(id)
formatted_edit_image GET /images/:(id)/edit.:(format)
edit_image GET /images/:(id)/edit
formatted_image GET /images/:(id).:(format)
image GET /images/:(id)
                                    /
                            HEAD /images/{id}
                            POST /images/:image_id/members.:(format)
                            POST /images/:image_id/members
formatted_image_members GET /images/:image_id/members.:(format)
image_members GET /images/:image_id/members
formatted_image_new_member GET /images/:image_id/members/new.:(format)
image_new_member GET /images/:image_id/members/new
                            PUT /images/:image_id/members/:(id).:(format)
                            PUT /images/:image_id/members/:(id)
                            DELETE /images/:image_id/members/:(id).:(format)
                            DELETE /images/:image_id/members/:(id)
formatted_image_edit_member GET /images/:image_id/members/:(id)/edit.:(format)
image_edit_member GET /images/:image_id/members/:(id)/edit
formatted_image_member GET /images/:image_id/members/:(id).:(format)
image_member GET /images/:image_id/members/:(id)
                                    /shared-images/{id}
                            PUT /images/{image_id}/members

so all these URLs can be accessed, eg:

$ curl -v -k -H 'x-auth-token: XXX' https://localhost:9292/v1/images/new

is actually considered a route 'match' and returns a 500 rather than a 404.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/31221

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/31221
Committed: http://github.com/openstack/glance/commit/519c0a6be124468d2158cd8e5f7f08f7dcd55125
Submitter: Jenkins
Branch: master

commit 519c0a6be124468d2158cd8e5f7f08f7dcd55125
Author: Stuart McLaren <email address hidden>
Date: Fri May 31 14:20:40 2013 +0000

    Remove routes collection mappings

    When using the routes mapper's collection to map from URLs to
    python functions several additional URIs are created by
    default: 'new', 'format' and 'edit', eg this URI

    /v1/images/new

    was accessible and would return a '500'.

    /v1/images/detail.xxx

    was accessible and a 'GET' to it would create a file called 'detail.xxx'
    in the image cache directory (where 'xxx' is an arbitrary string).

    Similar resources for image memberships existed.

    Other collection URIs (for both the API and Registry) would return
    unexpected behaviour.

    Use explicit mappings rather than a 'collection' to remove
    the superfluous resources.

    Fixes bug 1185828.

    Change-Id: I2f451f0208d43cdc83dcf58a41ea31359b18fcf2

[Rushi Agrawal (rushiagr)]

Can't reproduce with latest cinder. Please revert the status if it can be reproduced again..

[Sean McGinnis (sean-mcginnis)]

Closing stale bug. If this is still an issue please reopen.