Comment 95 for bug 2059809

Revision history for this message
Dan Smith (danms) wrote : Re: Arbitrary file access through QCOW2 external data file

Sylvain, it's a bug to detect the file format from the code. It's an exploit path to upload something you say is a raw, and us end up passing a qcow to qemu. Everywhere else, we use -f to force the format, and qemu-img won't even let you do certain operations without passing the format *because* it's unsafe to do so. I thought we had converted all our uses to format-explicit, but this one was not, probably because we don't have the glance info available here.

So, no, I don't think it should be optional.