Having a '{' or '}' in password causes formatting errors
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | os-client-config |
Fix Released
|
High
|
John Dennis | |
Bug Description
On Arch Linux, all commands exit with the error "unmatched '{' in format", and nothing else. I'm using the following package versions:
python2-cliff 2.2.0-1
python2-
python2-osc-lib 1.2.0-1
Running "openstack2 server list --debug" yields:
START with options: [u'server', u'list', u'--debug']
options: Namespace(
Auth plugin password selected
auth_
Deferring keystone exception: argument of type 'OSC_Config' is not iterable
unmatched '{' in format
Traceback (most recent call last):
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
**kwargs
File "/usr/lib/
config[key] = value.format(
ValueError: unmatched '{' in format
Traceback (most recent call last):
File "/usr/lib/
ret_val = super(OpenStack
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
**kwargs
File "/usr/lib/
config[key] = value.format(
ValueError: unmatched '{' in format
END return value: 1
I get a similar error with the Python 3 version: "openstack server list --debug"
START with options: ['server', 'list', '--debug']
options: Namespace(
Auth plugin password selected
auth_
Deferring keystone exception: argument of type 'OSC_Config' is not iterable
unmatched '{' in format spec
Traceback (most recent call last):
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
**kwargs
File "/usr/lib/
config[key] = value.format(
ValueError: unmatched '{' in format spec
Traceback (most recent call last):
File "/usr/lib/
ret_val = super(OpenStack
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
File "/usr/lib/
**kwargs
File "/usr/lib/
config[key] = value.format(
ValueError: unmatched '{' in format spec
END return value: 1
It appears that this might be related to an incorrect regex: https:/
| Brian Davidson (bjdavidson) wrote : | #1 |
| Jon Gjengset (jonhoo) wrote : | #2 |
Ah, I didn't even think of that. Yes, that is the case for me as well!
| Steve Martinelli (stevemar) wrote : | #3 |
Ah, that actually helps out a lot. I was having trouble reproducing this issue.
| Ray Harris (lrh1) wrote : | #4 |
It appears that any "{" or "}" in a password must be duplicated to avoid those characters being treated as part of a format spec.
It's unacceptable that a password has to be modified before being entered to avoid errors.
| Steve Martinelli (stevemar) wrote : | #5 |
@Ray, totally agree. I'll see if I can investigate this issue further.
| Changed in python-openstackclient: | |
| status: | New → Confirmed |
| importance: | Undecided → High |
| summary: |
- unmatched '{' in format printed for all commands + Having a '{' or '}' in password causes formatting errors |
| Dean Troyer (dtroyer) wrote : | #6 |
This appears to be a result of os-client-config attempting to do nested expansion of config values. It will probably happen with any config value containing a '{' char. Yay new format syntax!
I think we're going to have to escape '{" and '}' chars now.
| affects: | python-openstackclient → os-client-config |
I alsoe have this bug using "{" in a password.
if I', going to escape it using "{{" in my environment variable I still get back that I'm not authorized.
I added a debug output to "keystoneauth1/
| Ben Ritter (britter) wrote : | #8 |
If you need a temporary fix, this worked for me:
in /usr/lib/
1079 for (key, value) in config.items():
1080 if hasattr(value, 'format'):
1081 # config[key] = value.format(
1082 config[key] = value
| John Dennis (jdennis-a) wrote : | #9 |
I have a proposed fix for this I'll be submitting momentarily.
At first glance Dean's suggestion in comment #6 seems like the right approach, escape the config values but that does not work because:
1) Escaping all braces breaks valid use of the format string syntax.
2) Trying to determine exactly which braces should be escaped and which should be preserved is a daunting task and likely would not be robust.
3) Some strings might look like valid format syntax but still should be escaped (e.g. "foo{bar}", if this appeared in a password we wouldn't escape it and there would be a key error on the 'bar' key.
4) In general passwords should never be modified, you never want to apply formatting to them.
I believe the right approach is to maintain a list of config values which are excluded from having formatting applied to them. At the moment that list just includes 'password' but perhaps down the road other exceptions might crop up. The proposed patch follows this approach, the list of excluded values can easily be updated if others are discovered.
| Changed in os-client-config: | |
| assignee: | nobody → John Dennis (jdennis-a) |
As quick workaround I am using the attached patch.
In fact I agree that a password should never be modified.
| John Dennis (jdennis-a) wrote : | #11 |
For some reason the gerrit review with the proposed fix was not automatically linked to this bug.
The proposed fix is: https:/
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit c7243f1747b679c
Author: John Dennis <email address hidden>
Date: Tue Dec 5 15:19:56 2017 -0500
Do not apply format expansions to passwords
get_one_cloud() and get_one_cloud_osc() iterate over config
values and try to expand any variables in those values by
calling value.format(), however some config values
(e.g. password) should never have format() applied to them, not
only might that change the password but it will also cause the
format() function to raise an exception if it can not parse the
format string. Examples would be single brace (e.g. 'foo{')
which raises an ValueError because it's looking for a matching
end brace or a brace pair with a key value that cannot be found
(e.g. 'foo{bar}') which raises a KeyError.
It is not reasonsable to try to escape any braces because:
1) Escaping all braces breaks valid use of the format string syntax.
2) Trying to determine exactly which braces should be escaped and
which should be preserved is a daunting task and likely would not be
robust.
3) Some strings might look like valid format syntax but still should
be escaped (e.g. "foo{bar}", if this appeared in a password we
wouldn't escape it and there would be a key error on the 'bar' key.
4) In general passwords should never be modified, you never want to
apply formatting to them.
The right approach is to maintain a list of config values which are
excluded from having formatting applied to them. At the moment that
list just includes 'password' but perhaps down the road other
exceptions might crop up. This patch follows this approach,
the list of excluded values can easily be updated if others are
discovered.
Change-Id: I187bdec582d4c2
Closes-Bug: 1635696
Signed-off-by: John Dennis <email address hidden>
| Changed in os-client-config: | |
| status: | Confirmed → Fix Released |
This issue was fixed in the openstack/
This issue was fixed in the openstack/
In my case, I am hitting this bug when I have a '{' in my openstack user password.