url quoting breaks x-image-meta-location

Bug #1788942 reported by iain MacDonnell
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Glance Client
Fix Released
Critical
iain MacDonnell
Rocky
Fix Committed
Critical
iain MacDonnell
Stein
Fix Released
Critical
iain MacDonnell

Bug Description

With latest glanceclient:

# openstack image create --os-image-api-version 1 --location http://web_server/glance-images/cirros.img cirros
400 Bad Request: External sources are not supported: 'http%3A//web_server/glance-images/cirros.img' (HTTP 400)

This is caused by the quoting added in https://review.openstack.org/#/c/568698/

A quick-fix might be to add ':' to the "safe" list, or not do quoting at all for the 'x-image-meta-location' header, which is only used for the legacy v1 API.

Changed in python-glanceclient:
assignee: nobody → iain MacDonnell (imacdonn)
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-glanceclient (master)

Reviewed: https://review.openstack.org/597730
Committed: https://git.openstack.org/cgit/openstack/python-glanceclient/commit/?id=1156346dc243dc46bcc7c78a64454ff4bae7ddc5
Submitter: Zuul
Branch: master

commit 1156346dc243dc46bcc7c78a64454ff4bae7ddc5
Author: imacdonn <email address hidden>
Date: Thu Nov 1 21:36:11 2018 +0000

    Don't quote colon in HTTP headers

    Since the introduction of quoting of header content in
    https://review.openstack.org/568698, the 'x-image-meta-location' header
    has been broken, because urllib.quote() is really intended to be applied
    to only the path section of a URL, but in this case, it gets applied to
    the entire URL, and catches the colon that separates the scheme from the
    remainder of the URL.

    This change adds the colon to the list of characters that should not get
    quoted. Since a colon can be directly represented in ASCII, this should
    not invalidate the previous change.

    Change-Id: I76a1c9a361b6c9f6eb95ae766b8c3bcf2267703a
    Closes-Bug: #1788942

Changed in python-glanceclient:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to python-glanceclient (stable/rocky)

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/618362

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-glanceclient (stable/rocky)

Reviewed: https://review.openstack.org/618362
Committed: https://git.openstack.org/cgit/openstack/python-glanceclient/commit/?id=e0673a17fd684ca29ae6674f2df6303f99c79bce
Submitter: Zuul
Branch: stable/rocky

commit e0673a17fd684ca29ae6674f2df6303f99c79bce
Author: imacdonn <email address hidden>
Date: Thu Nov 1 21:36:11 2018 +0000

    Don't quote colon in HTTP headers

    Since the introduction of quoting of header content in
    https://review.openstack.org/568698, the 'x-image-meta-location' header
    has been broken, because urllib.quote() is really intended to be applied
    to only the path section of a URL, but in this case, it gets applied to
    the entire URL, and catches the colon that separates the scheme from the
    remainder of the URL.

    This change adds the colon to the list of characters that should not get
    quoted. Since a colon can be directly represented in ASCII, this should
    not invalidate the previous change.

    Change-Id: I76a1c9a361b6c9f6eb95ae766b8c3bcf2267703a
    Closes-Bug: #1788942
    (cherry picked from commit 1156346dc243dc46bcc7c78a64454ff4bae7ddc5)

tags: added: in-stable-rocky
Changed in python-glanceclient:
milestone: none → 2.13.1
milestone: 2.13.1 → none
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/python-glanceclient 2.15.0

This issue was fixed in the openstack/python-glanceclient 2.15.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/python-glanceclient 2.13.1

This issue was fixed in the openstack/python-glanceclient 2.13.1 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.