Bug #1634265 “yaml.load is a security risk, should use yaml.safe...” : Bugs : Heat Templates

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-10-18: Fix merged to monasca-agent (master)

#1

Reviewed: https://review.openstack.org/387680
Committed: https://git.openstack.org/cgit/openstack/monasca-agent/commit/?id=1e1f1309011e2b0adfda5d3ad9bc4027551c6c22
Submitter: Jenkins
Branch: master

commit 1e1f1309011e2b0adfda5d3ad9bc4027551c6c22
Author: Craig Bryant <email address hidden>
Date: Mon Oct 17 14:59:29 2016 -0600

Replace yaml.load() with yaml.safe_load()

Bandit flags yaml.load() as security risk so replace all occurrences
with yaml.safe_load()

Change-Id: I8d0b322b9083c63a75bc34caf2a67fc05d8a4390
Closes-Bug: #1634265

Changed in monasca:
status:	New → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-12-05: Fix included in openstack/monasca-agent 1.4.0

#2

This issue was fixed in the openstack/monasca-agent 1.4.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-16: Fix proposed to python-ironicclient (master)

#3

Fix proposed to branch: master
Review: https://review.openstack.org/420537

Changed in python-ironicclient:
assignee:	nobody → Tuan (tuanla)
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-16: Fix proposed to keystoneauth (master)

#4

Fix proposed to branch: master
Review: https://review.openstack.org/420572

Changed in keystoneauth:
assignee:	nobody → Tuan (tuanla)
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-16: Fix proposed to manila (master)

#5

Fix proposed to branch: master
Review: https://review.openstack.org/420582

Changed in manila:
assignee:	nobody → Tuan (tuanla)
status:	New → In Progress

Tuan (tuanla) on 2017-01-16

Changed in monasca:
assignee:	nobody → Tuan (tuanla)
assignee:	Tuan (tuanla) → nobody
Changed in heat-templates:
assignee:	nobody → Tuan (tuanla)
Changed in heat-translator:
assignee:	nobody → Tuan (tuanla)
Changed in cinder:
assignee:	nobody → Tuan (tuanla)
Changed in diskimage-builder:
assignee:	nobody → Tuan (tuanla)
Changed in karbor:
assignee:	nobody → Tuan (tuanla)

Revision history for this message

Boris Bobrov (bbobrov) wrote on 2017-01-16:

#6

Not a bug for keystoneauth, the only place this is used is in tests

no longer affects:

keystoneauth

Revision history for this message

Michael Dovgal (mdovgal) wrote on 2017-01-16:

#7

For cinder it's also not a bug. The only place where it is used it is driver test utils file

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-16: Fix merged to rally (master)

#8

Reviewed: https://review.openstack.org/420595
Committed: https://git.openstack.org/cgit/openstack/rally/commit/?id=8cec258b80e84d71ec48a472f976a437d8185e74
Submitter: Jenkins
Branch: master

commit 8cec258b80e84d71ec48a472f976a437d8185e74
Author: Luong Anh Tuan <email address hidden>
Date: Mon Jan 16 16:14:38 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I4aac907c2a7ecf9a3f85a1a07ca020df6eb0b756
Closes-Bug: #1634265

Changed in rally:
status:	New → Fix Released

Dmitry Tantsur (divius) on 2017-01-16

Changed in python-ironicclient:
importance:	Undecided → High

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-16: Fix merged to python-ironicclient (master)

#9

Reviewed: https://review.openstack.org/420537
Committed: https://git.openstack.org/cgit/openstack/python-ironicclient/commit/?id=c3f1cb56a11349cde48034d135976cf2e29856d2
Submitter: Jenkins
Branch: master

commit c3f1cb56a11349cde48034d135976cf2e29856d2
Author: Luong Anh Tuan <email address hidden>
Date: Mon Jan 16 14:30:45 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Bandit flags yaml.load() as security risk so replace all occurrences
    with yaml.safe_load().

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I6db250c03b8a9ca1942e1809831190b0e10423a5
Closes-Bug: #1634265

Changed in python-ironicclient:
status:	In Progress → Fix Released

Revision history for this message

Eric Harney (eharney) wrote on 2017-01-16:

#10

cinder only does this in unit tests.

Changed in cinder:
status:	New → Invalid
assignee:	Tuan (tuanla) → nobody

Tuan (tuanla) on 2017-01-17

Changed in rally:
assignee:	nobody → Tuan (tuanla)
Changed in keystoneauth:
assignee:	nobody → Tuan (tuanla)
status:	New → Fix Released
Changed in diskimage-builder:
status:	New → In Progress
Changed in heat-templates:
status:	New → In Progress

Anthony Washington (anthony-washington) on 2017-01-17

Changed in tempest:
assignee:	nobody → Anthony Washington (anthony-washington)
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-17: Fix proposed to tempest (master)

#11

Fix proposed to branch: master
Review: https://review.openstack.org/421566

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-17: Change abandoned on tempest (master)

#12

Change abandoned by Anthony Washington (<email address hidden>) on branch: master
Review: https://review.openstack.org/421566
Reason: Someone pushed already.

Revision history for this message

Anthony Washington (anthony-washington) wrote on 2017-01-17:

#13

Change was pushed already for tempest : https://review.openstack.org/#/c/420616/1

Changed in tempest:
status:	In Progress → Fix Committed
assignee:	Anthony Washington (anthony-washington) → nobody

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-18: Fix merged to tempest (master)

#15

Reviewed: https://review.openstack.org/420616
Committed: https://git.openstack.org/cgit/openstack/tempest/commit/?id=40d02088e41df58526508c079e46b19cd14fe3ee
Submitter: Jenkins
Branch: master

commit 40d02088e41df58526508c079e46b19cd14fe3ee
Author: Dao Cong Tien <email address hidden>
Date: Mon Jan 16 16:59:18 2017 +0700

Replaces yaml.load() with yaml.safe_load()

    Yaml.load() return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load() limits this ability to
    simple Python objects like integers or lists.

Reference:
https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I85c5a4e17bc79c62d946a1dd0c9e85b527961926
Partial-Bug: #1634265

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-18: Fix merged to diskimage-builder (master)

#16

Reviewed: https://review.openstack.org/420553
Committed: https://git.openstack.org/cgit/openstack/diskimage-builder/commit/?id=ff8ae432653baaf3ee343669d2617e9968acb19f
Submitter: Jenkins
Branch: master

commit ff8ae432653baaf3ee343669d2617e9968acb19f
Author: Luong Anh Tuan <email address hidden>
Date: Mon Jan 16 15:01:51 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I84640973fd9f45a69d2b21f6d594cd5bf10660a6
Closes-Bug: #1634265

Changed in diskimage-builder:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-18: Fix merged to monasca-notification (master)

#17

Reviewed: https://review.openstack.org/421019
Committed: https://git.openstack.org/cgit/openstack/monasca-notification/commit/?id=6f75509f9cd953fc1b29e8dd20fe3769c565ab70
Submitter: Jenkins
Branch: master

commit 6f75509f9cd953fc1b29e8dd20fe3769c565ab70
Author: Nam Nguyen Hoai <email address hidden>
Date: Wed Jan 18 09:26:49 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the Internet.
    The function yaml.safe_load limits this ability to simple Python
    objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

[1] https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I3f1a756e80b617ba1bcf824ef4dee9a27eb6887a
Closes-Bug: #1634265

Tuan (tuanla) on 2017-01-18

Changed in diskimage-builder:
importance:	Undecided → Wishlist
Changed in tempest:
assignee:	nobody → Dao Cong Tien (tiendc)
importance:	Undecided → Wishlist

Tuan (tuanla) on 2017-01-18

Changed in cinder:
assignee:	nobody → Tuan (tuanla)
status:	Invalid → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-18: Fix proposed to tacker (master)

#18

Fix proposed to branch: master
Review: https://review.openstack.org/421687

Changed in tacker:
assignee:	nobody → Tuan (tuanla)
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-18: Fix included in openstack/keystoneauth 2.18.0

#19

This issue was fixed in the openstack/keystoneauth 2.18.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-19: Fix included in openstack/python-ironicclient 1.10.0

#20

This issue was fixed in the openstack/python-ironicclient 1.10.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-19: Fix merged to sahara-tests (master)

#21

Reviewed: https://review.openstack.org/421681
Committed: https://git.openstack.org/cgit/openstack/sahara-tests/commit/?id=0939e815f97e5e2df43ef3660308cddcd560ab3c
Submitter: Jenkins
Branch: master

commit 0939e815f97e5e2df43ef3660308cddcd560ab3c
Author: Luong Anh Tuan <email address hidden>
Date: Wed Jan 18 13:12:35 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I7e440eda0ba0e5f66c88b418112d48a9b4b0b84d
Closes-Bug: #1634265

Changed in sahara-tests:
status:	New → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-19: Fix merged to app-catalog (master)

#22

Reviewed: https://review.openstack.org/421664
Committed: https://git.openstack.org/cgit/openstack/app-catalog/commit/?id=cf81bd39a6ebe28d31db48c09d982f9f9d310b6e
Submitter: Jenkins
Branch: master

commit cf81bd39a6ebe28d31db48c09d982f9f9d310b6e
Author: Luong Anh Tuan <email address hidden>
Date: Wed Jan 18 11:46:33 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: Ife71148013d5f94ec5ae62633ff9a41f419bd3b7
Closes-Bug: #1634265

Changed in app-catalog:
status:	New → Fix Released

Revision history for this message

ravig (ravig) wrote on 2017-01-20:

#23

There are around 5 places where this has to be modified. Will work on it and provide a patch.

Changed in kolla-kubernetes:
assignee:	nobody → ravig (ravig)
status:	New → Confirmed

OpenStack Infra (hudson-openstack) on 2017-01-23

Changed in karbor:
status:	New → In Progress
Changed in heat-translator:
status:	New → In Progress

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-25: Fix proposed to diskimage-builder (master)

#24

Fix proposed to branch: master
Review: https://review.openstack.org/424988

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-25: Change abandoned on diskimage-builder (master)

#25

Change abandoned by Ian Wienand (<email address hidden>) on branch: master
Review: https://review.openstack.org/424988
Reason: wrong branch

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-25: Fix proposed to diskimage-builder (feature/v2)

#26

Fix proposed to branch: feature/v2
Review: https://review.openstack.org/424989

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-27: Fix included in openstack/python-tripleoclient 6.0.0

#27

This issue was fixed in the openstack/python-tripleoclient 6.0.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-30: Fix merged to heat-translator (master)

#28

Reviewed: https://review.openstack.org/420564
Committed: https://git.openstack.org/cgit/openstack/heat-translator/commit/?id=3cf56881413adf39963401279a84a3cc3fce19b9
Submitter: Jenkins
Branch: master

commit 3cf56881413adf39963401279a84a3cc3fce19b9
Author: Luong Anh Tuan <email address hidden>
Date: Mon Jan 16 15:20:45 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: Ifaecff145e91f72911ae05ea274a4977c56212c7
Closes-Bug: #1634265

Changed in heat-translator:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-01-31: Change abandoned on diskimage-builder (feature/v2)

#29

Change abandoned by Ian Wienand (<email address hidden>) on branch: feature/v2
Review: https://review.openstack.org/424989
Reason: i'm going to try this in smaller increments

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-02-02: Fix included in openstack/sahara-tests 0.4.0

#30

This issue was fixed in the openstack/sahara-tests 0.4.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-02-03: Fix proposed to diskimage-builder (feature/v2)

#31

Fix proposed to branch: feature/v2
Review: https://review.openstack.org/428519

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-02-03: Fix merged to diskimage-builder (feature/v2)

#32

Download full text (18.6 KiB)

Reviewed: https://review.openstack.org/428519
Committed: https://git.openstack.org/cgit/openstack/diskimage-builder/commit/?id=3f8800832a32ed1523cad6ed5a786141f0a6385a
Submitter: Jenkins
Branch: feature/v2

commit 83bdfe179a549e9ae3cd61e4f15383f77d668c11
Author: Ian Wienand <email address hidden>
Date: Tue Jan 31 14:20:09 2017 +1100

Git ignore coverage stuff

One less piece of clutter when you're trying to merge ...

Change-Id: I794027280359f5d1e02d4f3b99222d35783075d5

commit 11d384e2fa1f550d424f686600d643b3969a40b3
Author: Andrey Shestakov <email address hidden>
Date: Thu Jan 5 14:39:25 2017 +0200

Add DIB_IPA_COMPRESS_CMD option

    This option allows to specifiy command for compress built initramfs image
    for ironic-agent element. This command can be specified with arguments and
    should read raw data from stdin and write compressed data to stdout.
    Default if "gzip".

Change-Id: I0fdd2ab91d7bf7aaaa6cdd5278e3902d44c5b883

commit ca60b2cf7d30a8978ae9166a23bfee1bca8f6f6a
Author: Ian Wienand <email address hidden>
Date: Mon Jan 23 14:20:36 2017 +1100

ironic-agent: use /sbin for modprobe

    On redhat/fedora /sbin is a symlink to /usr/sbin, but not on all
    platforms. This was put in with
    Ibf74dd1b2678ea76e0676711a7aa5ba6b88d5421

Change-Id: I7847b29503c3c07503430a7d85a5364911894c6c
Closes-bug: #1658297

commit dc8449bf02316f27b556994644f7c4ce18b995a8
Author: Matthew Thode <email address hidden>
Date: Sun Jan 22 15:53:02 2017 -0600

move post-install.d to finalize.d

    It looks like I installed the cleanup file in the wrong location. Moving it
    to the correct location and cleaning some more stuff up should allow for a
    much smaller image, currently tested at 300M vs 490M.

Change-Id: I9d0a24b0fe59d4f2d38aa88ba47e4400e0476b46

commit 90a347707c2c0e411052d9d54e00a3380f3e9ce3
Author: Paul Belanger <email address hidden>
Date: Thu Jan 12 11:55:47 2017 -0500

Bump fedora release to 25

Now that fedora-25 is released, bump fedora-minimal / fedora elements
to use it.

    Change-Id: Ifdb05255e7a138b99099252fe17041fe4621b6f4
    Depends-On: I3cc467a2d08486458b3f625f94ba969532f6cd04
    Signed-off-by: Paul Belanger <email address hidden>

commit a45ad8eaf56c16c8f77dc8f96fecaf224af4d5bf
Author: Andrey Shestakov <email address hidden>
Date: Tue Dec 6 23:59:49 2016 +0200

Fix dhcp-all-interfaces for ubuntu-minimal xenial

    The start script of dhcp-all-interfaces currently requires ifup command.
    ifup command provided by package ifupdown, which is not installed in
    ubuntu-minimal Xenial.

This change adds ifupdown package for debian family, as it required for
dhcp-all-interfaces.

Closes-bug: #1647853

Change-Id: I6dfc0108ec067f350b22e9fb933b9e8d47b09fde

commit 0ceb138d877101542934b7729f9497bc4c9a039a
Author: Ian Wienand <email address hidden>
Date: Wed Jan 18 08:32:10 2017 +1100

Don't set base element path in run_functests.sh

DIB automatically includes it's base elements in the ELEMENT_PATH;
this double-set means the base elements are in the path twice, ...

Reviewed:  https://review.openstack.org/428519
Committed: https://git.openstack.org/cgit/openstack/diskimage-builder/commit/?id=3f8800832a32ed1523cad6ed5a786141f0a6385a
Submitter: Jenkins
Branch:    feature/v2

commit 83bdfe179a549e9ae3cd61e4f15383f77d668c11
Author: Ian Wienand <iwienand@redhat.com>
Date:   Tue Jan 31 14:20:09 2017 +1100

Git ignore coverage stuff
    
    One less piece of clutter when you're trying to merge ...
    
    Change-Id: I794027280359f5d1e02d4f3b99222d35783075d5

commit 11d384e2fa1f550d424f686600d643b3969a40b3
Author: Andrey Shestakov <ashestakov@mirantis.com>
Date:   Thu Jan 5 14:39:25 2017 +0200

Add DIB_IPA_COMPRESS_CMD option
    
    This option allows to specifiy command for compress built initramfs image
    for ironic-agent element. This command can be specified with arguments and
    should read raw data from stdin and write compressed data to stdout.
    Default if "gzip".
    
    Change-Id: I0fdd2ab91d7bf7aaaa6cdd5278e3902d44c5b883

commit ca60b2cf7d30a8978ae9166a23bfee1bca8f6f6a
Author: Ian Wienand <iwienand@redhat.com>
Date:   Mon Jan 23 14:20:36 2017 +1100

ironic-agent: use /sbin for modprobe
    
    On redhat/fedora /sbin is a symlink to /usr/sbin, but not on all
    platforms.  This was put in with
    Ibf74dd1b2678ea76e0676711a7aa5ba6b88d5421
    
    Change-Id: I7847b29503c3c07503430a7d85a5364911894c6c
    Closes-bug: #1658297

commit dc8449bf02316f27b556994644f7c4ce18b995a8
Author: Matthew Thode <mthode@mthode.org>
Date:   Sun Jan 22 15:53:02 2017 -0600

move post-install.d to finalize.d
    
    It looks like I installed the cleanup file in the wrong location.  Moving it
    to the correct location and cleaning some more stuff up should allow for a
    much smaller image, currently tested at 300M vs 490M.
    
    Change-Id: I9d0a24b0fe59d4f2d38aa88ba47e4400e0476b46

commit 90a347707c2c0e411052d9d54e00a3380f3e9ce3
Author: Paul Belanger <pabelanger@redhat.com>
Date:   Thu Jan 12 11:55:47 2017 -0500

Bump fedora release to 25
    
    Now that fedora-25 is released, bump fedora-minimal / fedora elements
    to use it.
    
    Change-Id: Ifdb05255e7a138b99099252fe17041fe4621b6f4
    Depends-On: I3cc467a2d08486458b3f625f94ba969532f6cd04
    Signed-off-by: Paul Belanger <pabelanger@redhat.com>

commit a45ad8eaf56c16c8f77dc8f96fecaf224af4d5bf
Author: Andrey Shestakov <ashestakov@mirantis.com>
Date:   Tue Dec 6 23:59:49 2016 +0200

Fix dhcp-all-interfaces for ubuntu-minimal xenial
    
    The start script of dhcp-all-interfaces currently requires ifup command.
    ifup command provided by package ifupdown, which is not installed in
    ubuntu-minimal Xenial.
    
    This change adds ifupdown package for debian family, as it required for
    dhcp-all-interfaces.
    
    Closes-bug: #1647853
    
    Change-Id: I6dfc0108ec067f350b22e9fb933b9e8d47b09fde

commit 0ceb138d877101542934b7729f9497bc4c9a039a
Author: Ian Wienand <iwienand@redhat.com>
Date:   Wed Jan 18 08:32:10 2017 +1100

Don't set base element path in run_functests.sh
    
    DIB automatically includes it's base elements in the ELEMENT_PATH;
    this double-set means the base elements are in the path twice, leading
    to some tools that walk the element list (package-installs-squash, for
    example) to do things twice.
    
    Change-Id: Icf631427601cfd2abed436711cedb9e002fff8f9

commit baf3ced0c32072a5fa525277380a8777fc0a471a
Author: Ian Wienand <iwienand@redhat.com>
Date:   Wed Jan 18 15:07:46 2017 +1100

Fix coverage report
    
    There's a few things going on here
    
    Firstly, we need to install coverage tool in test-requirements
    
    Secondly, .testr.conf has to use PYTHON because the coverage report
    works by resetting PYTHON='coverage run ...'
    
    Thirdly, because we call ourselves diskimage-builder but the python
    module is diskimage_builder that seems to confuse things.  We need to
    use "setup.py test" (note, that is different to "setup.py testr"!) to
    use the PBR testr wrapper.  That exposes a --coverage-package-name
    argument that calls the coverage tool with the right argument.
    
    With this I got a coverage report for our unit tests
    
    Change-Id: I9012e18eb7d01bee035140e70afa76c47c27eb01

commit d20754f6ed0b76ebf695c4eadf877edce0536464
Author: Ben Nemec <bnemec@redhat.com>
Date:   Mon Dec 12 15:46:25 2016 -0600

Use %i instead of %I in dhcp-interface@.service
    
    Per the bug report, %I results in -'s in the interface name being
    replaced with /'s, which means when we try to look up the interface
    by path in dhcp-all-interfaces.sh we end up at an invalid path.
    Using %i instead should fix the problem.
    
    See https://www.freedesktop.org/software/systemd/man/systemd.unit.html
    
    Essentially what is happening is that we start with a name like
    br-ex that wasn't escaped in the first place.  However, because of
    the - it looks like it could have been escaped to systemd.  When
    we use %I, which tries to unescape escaped values, it unescapes a
    value that was already not escaped.
    
    Change-Id: I434ed2e084d4477dc7a2b7827164586f8ea0c1e3
    Closes-Bug: 1649409

commit 1f43432313950930704f820a723a65320e31f93c
Author: Paul Belanger <pabelanger@redhat.com>
Date:   Fri Dec 23 12:38:07 2016 -0500

Remove hardcoded components
    
    We can use ${DIB_DEBIAN_COMPONENTS} to get this information. We also
    already set the mirror.
    
    Change-Id: Idd11c2b7df1d247c6d32a5f936b8601b4741b519
    Signed-off-by: Paul Belanger <pabelanger@redhat.com>

commit 6c8d7432a6e9797ed8777770e8d4325b00bf5271
Author: Ian Wienand <iwienand@redhat.com>
Date:   Fri Nov 25 11:08:11 2016 +1100

Set grub device in /etc/default/grub
    
    Currently we run grub-mkconfig then go and edit the generated output
    in /boot/grub/grub.cfg to override the "root=" arguments to our label.
    
    If another element like project-config's
    finalise.d/99-fix-grub-timeout then goes and re-runs grub2-install, it
    overwrites these changes.
    
    Grub has GRUB_DEVICE which should override the root device.  Let's try
    using this.  Maybe it wasn't around at the time, this code is
    more-or-less unchanged from I7d83bb2b359e7a8c3858eca04c96e35cf4e1fe9e
    
    Change-Id: Ibaaa81124098f3c6febe48e455d3e1cd0a5f1761

commit ff8ae432653baaf3ee343669d2617e9968acb19f
Author: Luong Anh Tuan <tuanla@vn.fujitsu.com>
Date:   Mon Jan 16 15:01:51 2017 +0700

Replace yaml.load() with yaml.safe_load()
    
    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.
    
    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()
    
    [1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html
    
    Change-Id: I84640973fd9f45a69d2b21f6d594cd5bf10660a6
    Closes-Bug: #1634265

commit 022d93ee822e71245af52c4cf8f8a8e82f599af3
Author: Andreas Florath <andreas@florath.net>
Date:   Sat Jan 14 09:35:24 2017 +0000

Unify tidy up logs in lib/img-functions
    
    Cleaning logs was split, some was done in the
    img-functions.finalise_base, some was done in the base element.
    The version unifies tidy up logs in the lib/img-functions.
    Especially when building docker container images the base element
    cannot be used. This patch removes about some hundreds KB of
    useless logs in cases when the base element is not used.
    
    Change-Id: I165bafb73daf9144c2f3a83930e85e8d8cf5fae3
    Signed-off-by: Andreas Florath <andreas@florath.net>

commit 812ded362dcf042f7eef258ccdae0d1d8aa05334
Author: Ian Wienand <iwienand@redhat.com>
Date:   Fri Jan 13 15:45:56 2017 +1100

Also check bin/ for tabs
    
    Add bin/ to dib-lint basic script checks
    
    Change-Id: I92849ab608a6c792d790f041dc7614278c274d30

commit f8eba14d999a236e350e303d900d95174d524258
Author: Bob Fournier <bfournie@redhat.com>
Date:   Thu Jan 12 10:22:43 2017 -0500

Handle failure of carrier check in dhcp-all-interfaces.sh
    
    As described in the bug, there are conditions with certain switches
    in which the interface is 'admin down'ed during initialization.
    Doing a 'cat' on /sys/class/net/<interface>/carrier when it is
    'admin down'ed produces an 'Invalid Argument' error and the script
    terminates.  What this fix does is ignore failures of the 'cat'
    operation (by '|| echo 0') and place the link up inside the retry
    loop.
    
    Change-Id: I4f098aa5078b8482681394a3e9a6b17ed4bd4451
    Closes-Bug: 1654046

commit 6c5234e162319f007e9fce03a8b50bd2a3a12c46
Author: Matthew Thode <mthode@mthode.org>
Date:   Tue Dec 20 21:49:25 2016 -0600

Fix Gentoo builds on Ubuntu 16.04 Xenial hosts
    
    Xenial's bind of /dev into the chroot includes /dev/shm which is in
    use by the host.  An alternitive fix for this would be to use rbind
    to recursivly bind mount /dev instead of just the base bind of /dev
    
    Change-Id: I2c0f70afd1e82dd52a522f0dd2b3ea618b30b6c6

commit ccd00b10b2ef7e447f8bcbcad0fa391ba2706271
Author: Ben Nemec <bnemec@redhat.com>
Date:   Wed Jan 4 11:21:03 2017 -0600

Make DHCP timeout configurable
    
    As noted in the bug, there may be circumstances where a longer
    timeout than the current default is needed.  This patch allows users
    to tune this timeout for their environment if need be.
    
    Change-Id: I173f3dad684894fbc3c27dece5ae15b5f63bae5a
    Closes-Bug: 1654027

commit 5bed4a6d5e0e037a41931a840c4399e844631cfb
Author: Ben Nemec <bnemec@redhat.com>
Date:   Wed Jan 4 10:49:59 2017 -0600

Run dhcp-interface@.service after network.target
    
    When we configure dhcp interfaces before network.target has run,
    network.target will try to bring up those interfaces a second time
    after our service does so.  This causes two issues - first, the
    network target will always fail because it can't bring up an
    interface that is already up, and second, when configuring interfaces
    that don't actually have an available DHCP server it will result in
    a five minute delay waiting for DHCP on those interfaces.  This will
    also cause the network target to fail and is an unnecessary delay.
    
    By moving the dhcp-interface service to run after the network
    target we avoid both of these problems.  network.target will still
    bring up the interfaces on subsequent boots.  This could result in
    the five minute delay happening on reboots, but the expected use
    case for interfaces without DHCP is that they would be configured
    statically on initial deployment so this should be a minor issue.
    
    The dhcp-interface service is also configured to run before the
    network-online target so that services which depend on the network
    actually being available will not race the DHCP process.
    
    A snippet from /var/log/messages on a node with this patch applied
    is included in the bug to demonstrate the behavior described above.
    
    Change-Id: I5cfabf20f920beea52abf4c42362b6f6ac0b37c4
    Closes-Bug: 1653812

commit 197ab47226e0ecfed3e9ffdb0ff0db1ea0d7cb00
Author: Julia Kreger <juliaashleykreger@gmail.com>
Date:   Tue Jan 3 23:34:13 2017 +0000

Update component docs to refer to ironic-agent
    
    The components documentation was previously referring to the
    ramdisk image for deployment, which was previously deprecated.
    
    Corrected to point to the ironic-agent element.
    
    Change-Id: I770460041eb13523896aaadb7705bdc3db1a54ca

commit 1d4bb048531c8fc77f91c35f5b1ca5756fd52e15
Author: Cady_Chen <chenyingnan@inspur.com>
Date:   Thu Dec 22 22:52:17 2016 +0800

Change "Openstack" to "OpenStack"
    
    According to the word choice convention in
    http://docs.openstack.org/contributor-guide/writing-style/word-choice.html
    We should use OpenStack instead of Openstack.
    
    Change-Id: I66f0bf9eb81593220eb0000fe8192c478e8d075d

commit d6fe34cc59ec6de91f43d2c15b92d82ee1266ebf
Author: Matthew Thode <mthode@mthode.org>
Date:   Fri Dec 23 20:02:38 2016 -0600

update pkg-map entries for python3
    
    Map python3 packages properly, or else we get invalid package names.
    
    Change-Id: I7af8621c856c689840a11d3cb9d094f02a0b9593

commit 7337c9e706985148c988626814830a4768d1f6ba
Author: Andreas Florath <andreas@florath.net>
Date:   Wed Dec 21 20:18:12 2016 +0000

dib-lint: python3 compatibility fixes
    
    When using up to date distributions for dib development, pep8
    installs using python3.  This patch fixes the problem, that
    not the complete dib-lint (which is called) is compatible
    with python3.
    
    Change-Id: I417d03746edb4d34011b997edf8b5b9662ea6f09
    Signed-off-by: Andreas Florath <andreas@florath.net>

commit f6ecfb3b24448c38d1dea1379077bc804a2987fc
Author: xhzhf <guoyongxhzhf@163.com>
Date:   Wed Dec 21 22:10:50 2016 +0800

H803 hacking have been deprecated
    
    H803 hacking have been removed.
    https://github.com/openstack-dev/hacking/blob/master/setup.cfg
    Closes-Bug: #1650741
    
    Change-Id: Ic88b431d9260c6e31717b001ff657d10d76b9213

commit 0576d20d49fbbf07d30adc05caca3d749550c06d
Author: Pierre Riteau <priteau@uchicago.edu>
Date:   Wed Dec 21 11:49:27 2016 +0000

Update documented default Ubuntu version
    
    Since commit fd5fbdd4b5c15c613133c5a18c8e83b486ec1dd0 xenial is the
    version used by default.
    
    Change-Id: I18e01d806635539b2d6c8a4e6b2d25460647c910

commit 2209d343720f994a71d9451c4b9297af969f7bf5
Author: Antoine Musso <hashar@free.fr>
Date:   Tue Dec 6 15:51:12 2016 +0100

debootstrap: avoid duplicate network configuration
    
    On Debian network configuration can be done via /etc/network/interfaces.
    It can accept a statement to load additional files, which varied in
    history:
    
    Wheezy only supports 'source' (see b822581)
    Jessie supports 'source-directory' and comes with the statement by
    default.
    
    However since 754dd05 we inconditionally inject 'source', thus on Jessie
    the configuration ends up with:
    
     source-directory /etc/network/interfaces.d/*
     source /etc/network/interfaces.d/*
    
    When networking is started, 'ifup -a' parses the list of interfaces
    twice. When configured with dhcp, that causes two dhclient to spawn
    which might conflict with each other.
    
    Inject the source statement only if there is neither a source or
    source-directory with the same path.
    
    Change-Id: Iefa9c9584f676e50481c621b4111eded3125a50b

commit 4585955a8b82889c61deb9ecb34b8713270406a7
Author: Ian Wienand <iwienand@redhat.com>
Date:   Fri Dec 9 14:41:24 2016 +1100

Remove yum chroot caching
    
    Every run we are doing a full tar.gz of the chroot environment that
    never gets used.
    
    It's not suitable for CI since we use fresh images each time there.
    
    The cache in general isn't really isn't a very safe thing to have
    around, because there's no invalidation procedure and no real way to
    make one -- we've no guarantee that a new chroot build even moments
    after a previous one wouldn't bring in or different packages, etc (of
    course this is *unlikely*, but the longer you go between builds the
    worse the problem becomes.  Also, tons of packages get installed after
    this not from any cache, so potential speed-up is rather marginal.
    
    Debian turned this off with I58fc485aacacaa17243bf9ce760ed91256d1f182.
    However, given the reasons above and it's complete lack of testing, I
    don't see this as useful.
    
    If we really want this type of thing, I think we should come up with a
    way to use a persistent external yum/dnf cache that yum/dnf keeps in
    sync with it's usual invalidation rules.
    
    Change-Id: I66789c35db75c41bc45ea1ad2e26f87456de4e4d

commit 6a40b607176857dc599ce9ca69da12b9bc1c6560
Author: Gregory Haynes <greg@greghaynes.net>
Date:   Tue Dec 6 16:08:28 2016 -0800

Create ubuntu/fedora test for pip-and-virtualenv
    
    This element does some funky stuff WRT python2 vs python3 so lets get
    some multi-distro testing in place.
    
    Change-Id: I1e3c3bfa0a109419d4cbee7fa32a18392b7e1a93

commit 8e3e66dfbd139f0180b40d73e1f65ff237a280d1
Author: Ian Wienand <iwienand@redhat.com>
Date:   Tue Dec 13 12:47:46 2016 +1100

Speed up chroot checking loop
    
    It was noticed on a very busy system this can take about 1s per loop.
    This starts to add up on thousands of processes.
    
    Firstly, prune out all the kernel threads.  Then introduce a very
    small inline python script to find any pids that seem to be in the
    chroot without forking to examine each one.  After that the existing
    loop just kills anything as before.
    
    Change-Id: Icc7bc7eda80ffcd636f97e6542d70c220e9c225e

commit cd1965f7b7e5d6a7ce31fdb816af00ad93166d5d
Author: Gregory Haynes <greg@greghaynes.net>
Date:   Thu Dec 8 15:30:56 2016 -0800

Allow disto-specific mirror settings
    
    Most of our distros support DIB_DISTRIBUTION_MIRROR for setting the
    mirror to be used when building. This has a major downside where if
    someone would like to create a static configuration for building various
    distro images it cannot set DIB_DISTRIBUTION_MIRROR (think of the case
    where we want to run our tests).
    
    By adding support for DIB_$DISTRO_DISTRIBUTION_MIRROR this problem is
    resolved.
    
    Change-Id: I92964b17ec3e47cf97e3a3091f054b2a205ac768

commit cb3e1076e31319aaea12108eb259bfa129be344f
Author: Aparna <aparnavtce@gmail.com>
Date:   Thu Nov 10 11:21:44 2016 +0000

Update hpssacli to ssacli in proliant-tools element
    
    This commit updates the CLI utility name hpssacli to
    ssacli  as part of company name change from HP to HPE.
    ssacli will work seamlessly for all the cases where
    hpssacli is used.
    
    It also updates the custom URL location for ssacli
    utility with new location.
    
    Change-Id: I2de4d3430e7308d25e36dc6960783699aa17dfae

commit 828f9279c0d3b7a5fc9377c768c0711a3dac92a2
Author: Andreas Florath <andreas@florath.net>
Date:   Sat Jul 16 14:52:30 2016 +0200

Spec for changing the block device handling: partitioning
    
    During the creation of a disk image (e.g. for a VM), there is the need
    to create, setup, configure and afterwards detach some kind of storage
    where the newly installed OS can be copied to or directly installed
    in.
    
    This document describes the details of partitioning.
    
    Change-Id: I72d8459e81d7da7a8feaebbf295d6c436a686a07
    Signed-off-by: Andreas Florath <andreas@florath.net>

tags:

added: in-feature-v2

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-02-08: Change abandoned on manila (master)

#33

Change abandoned by Tuan Luong-Anh (<email address hidden>) on branch: master
Review: https://review.openstack.org/420582

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-02-08: Change abandoned on tacker (master)

#34

Change abandoned by Tuan Luong-Anh (<email address hidden>) on branch: master
Review: https://review.openstack.org/421687

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-02-15: Fix included in openstack/monasca-notification 1.7.0

#35

This issue was fixed in the openstack/monasca-notification 1.7.0 release.

Yuval Brik (jhamhader) on 2017-03-19

tags:

removed: in-feature-v2

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-03-23: Fix merged to cinder (master)

#36

Reviewed: https://review.openstack.org/420541
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=ce7a31d5f87e0a77a4448937defb4e0a98a69163
Submitter: Jenkins
Branch: master

commit ce7a31d5f87e0a77a4448937defb4e0a98a69163
Author: Luong Anh Tuan <email address hidden>
Date: Mon Jan 16 14:40:52 2017 +0700

Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Bandit flags yaml.load() as security risk so replace all occurrences
    with yaml.safe_load().

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: Iba7924715c9ef66fec9f875f11a2261789e6aa0d
Closes-Bug: #1634265

Changed in cinder:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-03-31: Change abandoned on heat-templates (master)

#37

Change abandoned by Tuan Luong-Anh (<email address hidden>) on branch: master
Review: https://review.openstack.org/420562

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-03-31: Change abandoned on karbor (master)

#38

Change abandoned by Tuan Luong-Anh (<email address hidden>) on branch: master
Review: https://review.openstack.org/420567

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-04-11: Fix included in openstack/cinder 11.0.0.0b1

#39

This issue was fixed in the openstack/cinder 11.0.0.0b1 development milestone.

Ken'ichi Ohmichi (oomichi) on 2017-04-28

Changed in tempest:
status:	Fix Committed → Fix Released

Revision history for this message

dharmendra (dharmendra-kushwaha) wrote on 2017-04-28:

#40

Fixed in https://review.openstack.org/#/c/445784/

Changed in tacker:
milestone:	none → pike-1
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2017-05-02: Fix included in openstack/heat-translator 0.8.0

#41

This issue was fixed in the openstack/heat-translator 0.8.0 release.

Revision history for this message

Jason Grosso (jgrosso) wrote on 2019-08-08:

#42

this issue was fixed with https://review.opendev.org/#/c/429156/

Changed in manila:
status:	In Progress → Fix Released

Heat Templates

yaml.load is a security risk, should use yaml.safe_load

Bug Description

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to	Milestone
Cinder	Fix Released	Undecided	Tuan
Community App Catalog	Fix Released	Undecided	Unassigned
Heat Templates	In Progress	Undecided	Tuan
Heat Translator	Fix Released	Undecided	Tuan
Karbor	In Progress	Undecided	Tuan
Monasca	Fix Released	Undecided	Unassigned
OpenStack Data Processing ("Sahara") sahara-tests	Fix Released	Undecided	Unassigned
OpenStack Shared File Systems Service (Manila)	Fix Released	Undecided	Tuan
Rally	Fix Released	Undecided	Tuan
diskimage-builder	Fix Released	Wishlist	Tuan
keystoneauth	Fix Released	Undecided	Tuan
kolla-kubernetes	Confirmed	Undecided	ravig
python-ironicclient	Fix Released	High	Tuan
tacker	Fix Released	Undecided	Tuan	tacker pike-1 "p1"
tempest	Fix Released	Wishlist	Dao Cong Tien