Disallow unsafe tempurl operations to point to unauthorized data
Do not allow PUT tempurls to create pointers to other data. Specifically
disallow the creation of DLO object manifests by returning an error if a
non-safe tempurl request includes an X-Object-Manifest header regardless of
the value of the header.
This prevents discoverability attacks which can use any PUT tempurl to probe
for private data by creating a DLO object manifest and then using the PUT
tempurl to head the object which would 404 if the prefix does not match any
object data or form a valid DLO HEAD response if it does.
This also prevents a tricky and potentially unexpected consequence of PUT
tempurls which would make it unsafe to allow a user to download objects
created by tempurl (even if they just created them) because the result of
reading the object created via tempurl may not be the data which was uploaded.
[CVE-2015-5223]
Co-Authored-By: Kota Tsuyuzaki <email address hidden>
Closes-Bug: #1487450
(cherry-picked from commit 0694e1911d10a18075ff99462c96781372422b2c)
Reviewed: https:/ /review. fuel-infra. org/13258 ci/fuel- 5.1.1-updates/ 2014.1. 1
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-
Commit: f5e1b93e7f26e0e ebe08b6fa04d4b5 cbf5f769c4
Author: Clay Gerrard <email address hidden>
Date: Wed Oct 28 14:07:58 2015
Disallow unsafe tempurl operations to point to unauthorized data
Do not allow PUT tempurls to create pointers to other data. Specifically
disallow the creation of DLO object manifests by returning an error if a
non-safe tempurl request includes an X-Object-Manifest header regardless of
the value of the header.
This prevents discoverability attacks which can use any PUT tempurl to probe
for private data by creating a DLO object manifest and then using the PUT
tempurl to head the object which would 404 if the prefix does not match any
object data or form a valid DLO HEAD response if it does.
This also prevents a tricky and potentially unexpected consequence of PUT
tempurls which would make it unsafe to allow a user to download objects
created by tempurl (even if they just created them) because the result of
reading the object created via tempurl may not be the data which was uploaded.
[CVE-2015-5223]
Co-Authored-By: Kota Tsuyuzaki <email address hidden>
Closes-Bug: #1487450
(cherry-picked from commit 0694e1911d10a18 075ff99462c9678 1372422b2c)
Change-Id: I91161dfb0f089c 3990aca1b4255b5 20299ef73c8