Data source drivers allow execution of client methods not declared executable

[Eric K]

The data source drivers* allow the API invocation of client methods not declared to be executable and not intended to be called this way. For example, the drivers allow the execution of the client __init__ method.

*Affected: ceilometer, cinder, cloudfoundry, glance, heat, ironic, keystone, neutron, nova, swift, and vCenter
Unaffected: murano, plexxi

[Eric K (ekcs)]

The problem is that the method ExecutionDriver._execute_api(...) [in datasource_driver.py] doesn't check that an input action has been declared executable (and thus listed in ExecutionDriver.executable_methods). A solution is to change ExecutionDriver._execute_api(...) so that the check is performed.

[Eric K (ekcs)]

Madhu, just a quick note for you:
You may want to wait until this other fix is merged: https://bugs.launchpad.net/congress/+bug/1499025 (it should be merged by Monday: https://review.openstack.org/#/c/228706/ )

If you fix this bug before the other fix is merged, some tests will fail.

[Madhu Mohan Nelemane (mmohan-9)]

Thanks Eric, I have cherry-picked the from https://review.openstack.org/#/c/228706/ and adding my changes to that.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/231411

[Madhu Mohan Nelemane (mmohan-9)]

Work in progress in: https://review.openstack.org/#/c/231411/

[Tim Hinrichs (thinrichs)]

Mismarked this as having been finished. Was thinking we already had it finished b/c the inspect method in datasource_util ignores methods starting with an _.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Tim Hinrichs (<email address hidden>) on branch: master
Review: https://review.openstack.org/231411
Reason: No progress in 6 months. Definitely WIP. Madhu, feel free to resurrect when you return to this.