Parameters to "create" are not validated in heat-cfn-api

[Zane Bitter]

The change https://review.openstack.org/#/c/88444/ moved validation of the input parameters to stack_create and stack_update from the engine to heat-api. This means that parameters passed to heat-cfn-api are no longer validated.

This could a major security hole, since it allows users to pass arbitrary arguments to the constructor of parser.Stack.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/92919

[Jeremy Stanley (fungi)]

Marking this incomplete for OSSA as a safety precaution, but just to confirm it looks to me like the bug was introduced after the Icehouse release, and so hasn't actually appeared in any stable release where an advisory would be warranted. Is that correct?

[Jason Dunsmore (jasondunsmore)]

That is correct Jeremy. Thanks.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/92919
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=5d1b4ab3e947f2974060a82208e08abd4b1fdac3
Submitter: Jenkins
Branch: master

commit 5d1b4ab3e947f2974060a82208e08abd4b1fdac3
Author: Jason Dunsmore <email address hidden>
Date: Fri May 9 09:31:12 2014 -0500

    Move API parameter parsing from OpenStack API to engine

    In commit 4169c1bd8ce4db0a794e22471994ea401b77b9c0, the API parameter
    parsing was moved to the OpenStack API. Since then, inputs to the CFN
    API were not being validated, creating a security hole.

    Change-Id: I21920591075bcefbe695316dab6605afd6f4ec64
    Closes-Bug: #1317667