Lack of advanced validation for PATCH request

Bug #1223847 reported by Roman Prykhodchenko
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Ironic
Fix Released
High
Lucas Alvares Gomes

Bug Description

Currently there's only a basic validation for PATCH requests which is the same for all resources.
In order to guarantee a fool-proof performance and better security it's better to provide resource-specific advanced validation of JSON patches.

We should find a way to do that automatically, i.e., by using Pecan hooks or similar tools.

Tags: api json-patch
aeva black (tenbrae)
Changed in ironic:
status: New → Triaged
importance: Medium → High
Changed in ironic:
assignee: nobody → Lucas Alvares Gomes (lucasagomes)
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to ironic (master)

Reviewed: https://review.openstack.org/48656
Committed: http://github.com/openstack/ironic/commit/3d54732d24f994c2a9aa8a234814495d7f6d9ffc
Submitter: Jenkins
Branch: master

commit 3d54732d24f994c2a9aa8a234814495d7f6d9ffc
Author: Lucas Alvares Gomes <email address hidden>
Date: Thu Sep 26 16:41:20 2013 +0100

    Check for required fields on ports

    Currently the API on ports does not check for any required fields,
    this patch add such verifications + tests.

    Change-Id: I4a2003c3a5ab0a0b31742fcac119fbe20929f636
    Partial-Bug: #1223847

Revision history for this message
aeva black (tenbrae) wrote :

I think that https://review.openstack.org/#/c/56682/ also addressed this bug, but it was not tagged there.

Lucas, should this bug be closed now?

Revision history for this message
Lucas Alvares Gomes (lucasagomes) wrote :

I think the next patches of that series will close it: https://review.openstack.org/#/c/56984/ https://review.openstack.org/#/c/57495/ https://review.openstack.org/#/c/57686/

I will add it to the commit message, thanks :)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to ironic (master)

Fix proposed to branch: master
Review: https://review.openstack.org/60194

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to ironic (master)

Reviewed: https://review.openstack.org/60194
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=9576c3edda8a782cc1c8271e66d1e302c6ba3672
Submitter: Jenkins
Branch: master

commit 9576c3edda8a782cc1c8271e66d1e302c6ba3672
Author: Lucas Alvares Gomes <email address hidden>
Date: Thu Dec 5 10:04:07 2013 +0000

    Add JsonPatchType class

    This patch adds the JsonPatchType class for API parameter validation with
    WSME. This class will be used to replace some of the custom validation
    functions we have in the api/utils.py.

    Change-Id: I233cd273854eae5ed4d8856d4af3e2f8e2309dce
    Partial-Bug: #1223847

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.openstack.org/56984
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=3e08bd535dbde6592962a17c87ebc8283eb143c2
Submitter: Jenkins
Branch: master

commit 3e08bd535dbde6592962a17c87ebc8283eb143c2
Author: Lucas Alvares Gomes <email address hidden>
Date: Mon Nov 18 16:58:20 2013 +0000

    Rework patch validation on Ports

    This makes use of the complex type objects of WSME and creates a type
    to validate json patch format.

    Change-Id: I17ea33efec16146d4ece90fd0ef5123faaacefb0
    Partial-Bug: #1223847

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.openstack.org/57495
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=812ab0d265c63b85a4747ec76a094af09f1a82bf
Submitter: Jenkins
Branch: master

commit 812ab0d265c63b85a4747ec76a094af09f1a82bf
Author: Lucas Alvares Gomes <email address hidden>
Date: Tue Nov 19 16:13:53 2013 +0000

    Reworks Node validations

    This makes use of the mandatory option and complex types of WSME to
    remove some of the custom validation code. The patch also includes a
    new attribute on Nodes API object called chassis_uuid to store the UUID
    of the chassis that Node belongs to, once this field is set it magically
    converts the UUID to the numeric ID of the chassis and sets the chassis_id
    attribute to be used internally.

    Change-Id: Ie51761a3b9a018d101a6335ea7bafb09393816d4
    Closes-Bug: #1252213
    Partial-Bug: #1223847

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Reviewed: https://review.openstack.org/57686
Committed: https://git.openstack.org/cgit/openstack/ironic/commit/?id=cd072ac607ca43f606247385088a3dde60165338
Submitter: Jenkins
Branch: master

commit cd072ac607ca43f606247385088a3dde60165338
Author: Lucas Alvares Gomes <email address hidden>
Date: Thu Nov 21 14:10:26 2013 +0000

    Reworks Chassis validations

    This makes use of complex types validations of WSME that now works.

    Change-Id: I5cd46d5c2caeb3f3c4cd1ef90448e7fd3c81404d
    Closes-Bug: #1223847

Changed in ironic:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in ironic:
milestone: none → icehouse-2
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in ironic:
milestone: icehouse-2 → 2014.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.