use of locals() is picking up unencoded variables, breaking requests

Bug #1775176 reported by Alfredo Deza
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Python Jenkins
New
Undecided
Unassigned

Bug Description

Jenkins uses a few unicode characters in places likes node labels. In our case, the labels exist in the function executing the request to get the node configuration, but the use of 'locals()' is picking that up and breaking on urllib:

      File "/opt/mita/src/mita/mita/util.py", line 341, in get_node_labels
        xml_configuration = _xml_configuration or conn.get_node_config(node_name)
      File "/opt/mita/local/lib/python2.7/site-packages/jenkins/__init__.py", line 1314, in get_node_config
        get_config_url = self._build_url(CONFIG_NODE, locals())
      File "/opt/mita/local/lib/python2.7/site-packages/jenkins/__init__.py", line 292, in _build_url
        url_path = format_spec % self._get_encoded_params(variables)
      File "/opt/mita/local/lib/python2.7/site-packages/jenkins/__init__.py", line 283, in _get_encoded_params
        params[k] = quote(v)
      File "/usr/lib/python2.7/urllib.py", line 1299, in quote
        return ''.join(map(quoter, s))
    KeyError: u'\u2018'

The commit that introduced this issue is: https://git.openstack.org/cgit/openstack/python-jenkins/commit/?id=827f28a223b03b4ffa025346081141cb1e6a5988

I would advise against the use of locals(), because it is tremendously easy to cause undesired side-effects that are hard to detect (it took us a while to understand where this character was coming from)

Revision history for this message
Alfredo Deza (cy-launchpad-deactivatedaccount) wrote :

It looks like I got the commit sha1 wrong for the cause of the variable bleeding. I am not sure what commit introduced the usage of locals, but is for sure how we got into the decoding problem. We are fixing this on our end by sanitizing the variable before calling get_node_config

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.