Ironic

  1. Bug #2030976
  2. Comment #40

Comment 40 for bug 2030976

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to oslo.messaging (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/oslo.messaging/+/891743
Committed: https://opendev.org/openstack/oslo.messaging/commit/bf0710d60fda74ec9d5afc31266edcee717c00eb
Submitter: "Zuul (22348)"
Branch: stable/zed

commit bf0710d60fda74ec9d5afc31266edcee717c00eb
Author: Jay Faulkner <email address hidden>
Date: Thu Aug 10 11:28:32 2023 -0700

    Only allow safe context fields in notifications

    Publishing a fully hydrated context object in a notification would give
    someone with access to that notification the ability to impersonate the
    original actor through inclusion of sensitive fields.

    Now, instead, we pare down the context object to the bare minimum before
    passing it for serialization in notification workflows.

    Closes-bug: 2030976
    Change-Id: Ic94323658c89df1c1ff32f511ca23502317d0f00
    (cherry picked from commit 1b315615e7dc61dbf845bd663560fc8d5a18fa09)