OpenStack Security Notes

  1. Bug #2048114
  2. Comment #27

Comment 27 for bug 2048114

Revision history for this message
Takashi Kajinami (kajinamit) wrote (last edit ): Re: OpenStack Murano Component Information Leakage

The overall problem is caused by the format method which internally does eval... I'm unsure if we can restrict the behavior in format or replace it without breaking the existing usage such as "{0}_{1}" or "{foo}_{bar}".

As a safe guard we can introduce an option to disable the format function completely. However it may affect any deployment, where a user is using the format yaql function with valid "safe" usage.

https://github.com/openstack/yaql/blob/0d63eb1346c829c0ce818dd2e00590af6330a0f3/yaql/standard_library/strings.py#L567-L596