Using a carriage return / line feed in an object name with a tempurl results in invalid http

Bug #1306250 reported by gholt
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
Fix Released
Undecided
Unassigned

Bug Description

Using a carriage return / line feed in an object name with a tempurl results in invalid http... For example:

    HTTP/1.1 200 OK
    Content-Length: 13
    Content-Disposition: attachment; filename="object
    4.txt"
    Accept-Ranges: bytes
    Last-Modified: Thu, 10 Apr 2014 15:28:18 GMT
    Etag: 1fa01959f1368b171485a6a04eedf24a
    X-Timestamp: 1397143697.50723
    Content-Type: text/plain
    X-Trans-Id: tx008aa403f43543be90118-0053470310iad3
    Date: Thu, 10 Apr 2014 20:46:08 GMT

    Testing Four

Revision history for this message
Openstack Gerrit (openstack-gerrit) wrote : Fix merged to swift (master)

Reviewed: https://review.openstack.org/86691
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=f469d4214f0d60a02a2f03edf512ad22e17432d7
Submitter: Jenkins
Branch: master

commit f469d4214f0d60a02a2f03edf512ad22e17432d7
Author: gholt <email address hidden>
Date: Tue Apr 22 15:00:09 2014 +0000

    TempURL: Fixed bug with \r or \n in disposition.

    If an object had a \r or \n in its name, it would end up creating an
    invalid HTTP Content-Disposition header. Reviewer consensus was to use
    URL encoding.

    Fixes bug 1306250

    Change-Id: Ibccaaed5152b4d09d6aee4966a1982cc0a0da07d

Changed in swift:
status: New → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/ec)

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/93823

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (feature/ec)
Download full text (9.7 KiB)

Reviewed: https://review.openstack.org/93823
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=aa8d5518d2080b3811cc74b9b9fcca0368fc7299
Submitter: Jenkins
Branch: feature/ec

commit 4cd3478b4b996108f5a581ef09add348e6246596
Author: Christian Berendt <email address hidden>
Date: Sun May 11 14:44:47 2014 +0200

    debug level logs should not be translated

    According to the OpenStack translation policy available at
    https://wiki.openstack.org/wiki/LoggingStandards debug messages
    should not be translated. Like mentioned in several changes in
    Nova by garyk this is to help prioritize log translation.

    Change-Id: I59486b1110f08510d83a4aec2a1666805c59d1cd
    Closes-Bug: #1318333

commit b4c5a136642bb87816bfbbad81b79efd4551a05e
Author: Brian Cline <email address hidden>
Date: Sat May 10 05:15:12 2014 -0500

    Uses None instead of mutables for function param defaults

    As seen on #1174809, changes use of mutable types as default
    arguments and defaults them within the method. Otherwise, those
    defaults can be unexpectedly persisted with the function between
    invocations and erupt into mass hysteria on the streets.

    There was indeed a test (TestSimpleClient.test_get_with_retries)
    that was erroneously relying on this behavior. Since previous tests
    had populated their own instantiations with a token, this test only
    passed because the modified headers dict from previous tests was
    being overridden. As expected, with the mutable defaults fix in
    SimpleClient, this test begain to fail since it never specified any
    token, yet it has always passed anyway. This change also now provides
    the expected token.

    Change-Id: If95f11d259008517dab511e88acfe9731e5a99b5
    Related-Bug: #1174809

commit 1dfe5186542486342581ab66cd5364b6b7d04e93
Author: Morgan Fainberg <email address hidden>
Date: Wed May 7 12:15:43 2014 -0700

    Update mailmap for Morgan Fainberg

    Change-Id: Ia46c28c86ef3f440556b1b027d2bf0a7f3e721c5

commit bcdafa3831111f334caadd30505f051c81abcb1f
Author: Eamonn O'Toole <email address hidden>
Date: Tue Apr 29 15:04:42 2014 +0100

    Sleep between object ZBF process forks

    We've found that, on fresh systems where the ZBF run completes
    almost instantaneously, the Swift logs (syslog by default) get
    filled-up with object ZBF scan start and completion messages.
    This patch calls self._sleep() between ZBF scan runs to cut-down
    on these messages and the related unnecessary ZBF scan runs
    without impacting the integrity of the object auditing process.

    Change-Id: I057c5ca235467cfa115a7a3d44e21c350900059a

commit 067b41e85479b29a7018e2f9ce7afd330bf3fdef
Author: Peter Portante <email address hidden>
Date: Sat Jan 11 00:18:04 2014 -0500

    In-process swift server for functional tests

    Provide a way to run the functional tests using a p/a/c/o server setup
    in the same process running the nosetests infrastructure.

    By setting the environment variable, SWIFT_TEST_IN_PROCESS, to a true
    value, the functional test framework will construct a set of proxy,
    account, container...

Read more...

Thierry Carrez (ttx)
Changed in swift:
status: Fix Committed → Fix Released
milestone: none → 2.0.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.