remove hardcoding for allowed_schemas parameter of urlfetch.get

Bug #1309691 reported by SnowDust
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Heat
Opinion
Undecided
SnowDust

Bug Description

https://github.com/openstack/heat/blob/master/heat/common/urlfetch.py#L37

the allowed_schemas parameter should be based on configuration defaults and not hardcoded in the function itself. This allows the override of allowed_schemes using heat configuration.

Changed in heat:
assignee: nobody → SnowDust (nilakhya-chatterjee)
description: updated
description: updated
Revision history for this message
Openstack Gerrit (openstack-gerrit) wrote : Fix proposed to heat (master)

Fix proposed to branch: master
Review: https://review.openstack.org/88659

Changed in heat:
status: New → In Progress
Revision history for this message
Thomas Herve (therve) wrote :

I don't think it's a good idea, until a proper use case is shown.

Changed in heat:
status: In Progress → Opinion
Revision history for this message
SnowDust (nilakhya-chatterjee) wrote :

discussing this with community it appears that the bugfix referenced is a security issue(therve said so) and no change is needed.

Changed in heat:
status: Opinion → Invalid
status: Invalid → Opinion
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.