In stable/juno if image is deleted while uploading is in progress (image is in saving state) then image_repo.get() will raise NotFound exception which is not caught, so it will not delete image data from the backend.
try:
# NOTE: Check if the Image is not deleted after setting the data
# before saving the active image. Here if image status is
# saving, then new_image is saved as it contains updated location,
# size, virtual_size and checksum information and the status of
# new_image is already set to active in set_image_data() call.
image = image_repo.get(image_id)
if image.status == 'saving': image_repo.save(new_image)
return image_id
else:
msg = _("The Image %(image_id)s object being created by this task " "%(task_id)s, is no longer in valid status for further " "processing.") % {"image_id": image_id, "task_id": task_id}
raise exception.Conflict(msg)
except (exception.Conflict, exception.NotFound):
with excutils.save_and_reraise_exception():
if new_image.locations:
for location in new_image.locations: store_utils.delete_image_location_from_backend( new_image.context, image_id, location)
Should I report this issue separately or it should be fixed in this same security bug.
Hi,
In stable/juno if image is deleted while uploading is in progress (image is in saving state) then image_repo.get() will raise NotFound exception which is not caught, so it will not delete image data from the backend.
https:/ /review. openstack. org/#/c/ 156553/ 1/glance/ common/ scripts/ image_import/ main.py
The code should be like,
try: get(image_ id)
image_ repo.save( new_image)
" %(task_ id)s, is no longer in valid status for further "
" processing. ") % {"image_id": image_id,
"task_ id": task_id} Conflict( msg) Conflict, exception. NotFound) : save_and_ reraise_ exception( ): locations: locations:
store_ utils.delete_ image_location_ from_backend(
new_ image.context,
image_ id,
location)
# NOTE: Check if the Image is not deleted after setting the data
# before saving the active image. Here if image status is
# saving, then new_image is saved as it contains updated location,
# size, virtual_size and checksum information and the status of
# new_image is already set to active in set_image_data() call.
image = image_repo.
if image.status == 'saving':
return image_id
else:
msg = _("The Image %(image_id)s object being created by this task "
raise exception.
except (exception.
with excutils.
if new_image.
for location in new_image.
Should I report this issue separately or it should be fixed in this same security bug.