Commit: 40e1bb2369e3ac1b7ce358bdcd9387fc44955af9
Author: Grant Murphy <email address hidden>
Date: Mon Nov 9 15:39:17 2015
Prevent file, swift+config and filesystem schemes
This change ensures that 'file', 'filesystem', and 'swift+config' URI
schemes are not allowed when setting the location field. A previous
fix to CVE-2014-9493 attempted to address this issue but did not
include 'filesystem', a URI scheme allowed by the glance_store.
Without this fix in place it is possible for a client to access any file
the glance-api server has read permissions for.
Closes-Bug: #1514467
(cherry picked from commit a2d986b976e9325a272e2d422465165315d19fe6)
Change-Id: I5fcf1d3e519e9d0dba9d00e65c8818292c206503
Reviewed: https:/ /review. fuel-infra. org/13746 ci/fuel- 6.0-updates/ 2014.2
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-
Commit: 40e1bb2369e3ac1 b7ce358bdcd9387 fc44955af9
Author: Grant Murphy <email address hidden>
Date: Mon Nov 9 15:39:17 2015
Prevent file, swift+config and filesystem schemes
This change ensures that 'file', 'filesystem', and 'swift+config' URI
schemes are not allowed when setting the location field. A previous
fix to CVE-2014-9493 attempted to address this issue but did not
include 'filesystem', a URI scheme allowed by the glance_store.
Without this fix in place it is possible for a client to access any file
the glance-api server has read permissions for.
Closes-Bug: #1514467 a272e2d42246516 5315d19fe6) 0dba9d00e65c881 8292c206503
(cherry picked from commit a2d986b976e9325
Change-Id: I5fcf1d3e519e9d