OpenStack Security Advisory

  1. Bug #1482371
  2. Comment #8

Comment 8 for bug 1482371

Revision history for this message
Stuart McLaren (stuart-mclaren) wrote : Re: Image status can be changed by passing header 'x-image-meta-status' with PUT operation using v1

From memory, those whitelisted headers are headers that are legal to return in a response to a user.

I think the idea was to prevent the leaking of a header that we don't want to return. So, when we return
a v1 response to a user the set of 'x-image-meta-...' headers that is possible for the user to see is defined
by this whitelist. (There had been a bug where we were returning something the user shouldn't see as a
header).