Comment 63 for bug 1496277

Revision history for this message
Steven Hardy (shardy) wrote : Re: template-validate may read server local files (CVE-2015-5295)

Well, there might be something we can do in heatclient to at least try to help users to (knowingly or unknowingly) do the wrong thing.

E.g, we could resolve "file:///dev/zero#a.yaml" and at least check that the resulting file we're reading is a regular file and perhaps ends with an expected extension, e.g yaml, yml, json etc.

But in general I agree with Zane, we tend to take the view that on the client side it's up to the user to ensure their configuration is sane and that they don't DoS themselves.