v1 in the API url seems to be a placeholder

Bug #1437442 reported by Anirup Duttta
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
Fix Released
High
John Dickinson

Bug Description

curl -ik -H 'X-Auth-Token: AUTH_****' -X GET http://127.0.0.1:8080/v0000.988/AUTH_******/test-container works

So does

curl -ik -H 'X-Auth-Token: AUTH_****' -X GET http://127.0.0.1:8080/b2/AUTH_******/test-container works

I was able to replicate the issue at account level as well.

Something like

curl -ik -H 'X-Auth-Token: AUTH_****' -X GET http://127.0.0.1:8080/b2/AUTH_****** works as well

I tested this with Swift 2.2.2

CVE References

Anirup Duttta (adutta)
description: updated
description: updated
Revision history for this message
clayg (clay-gerrard) wrote :

bah - that's annoying :'(

Changed in swift:
status: New → Confirmed
importance: Undecided → High
Revision history for this message
Christian Schwede (cschwede) wrote :

Indeed, this is annoying!

I submitted a small patch to fix this: https://review.openstack.org/#/c/168925/

Changed in swift:
assignee: nobody → Christian Schwede (cschwede)
Revision history for this message
Christian Schwede (cschwede) wrote :

Clay submitted a patch earlier on: https://review.openstack.org/#/c/168509/

Changed in swift:
assignee: Christian Schwede (cschwede) → clayg (clay-gerrard)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on swift (master)

Change abandoned by Christian Schwede (<email address hidden>) on branch: master
Review: https://review.openstack.org/168925
Reason: Duplicate

clayg (clay-gerrard)
Changed in swift:
assignee: clayg (clay-gerrard) → John Dickinson (notmyname)
Changed in swift:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (master)

Reviewed: https://review.openstack.org/168509
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=4aba2fbb25edf8936e00ee9f5736cc2c0c383c32
Submitter: Jenkins
Branch: master

commit 4aba2fbb25edf8936e00ee9f5736cc2c0c383c32
Author: Clay Gerrard <email address hidden>
Date: Fri Mar 27 15:50:38 2015 -0700

    Check if REST API version is valid

    Swift doesn't check if the used API version is valid. Currently there
    is only one valid REST API version, but that might change in the
    future.

    This patch enforces "v1" or "v1.0" as the version string when accessing
    account, containers and objects.

    The list of accepted version strings can be manually overridden using a
    comma-separated list in swift.conf to make this backward-compatible.
    The constraint loader has been modified slightly to accept strings as
    well as integers.

    Any request to an account, container, and object which does not
    provide the correct version string will get a 400 BadRequest response.

    The allowed api versions are by default excluded from /info.

    Co-Authored-By: Christian Schwede <email address hidden>
    Co-Authored-By: John Dickinson <email address hidden>

    Closes Bug #1437442

    Change-Id: I5ab6e236544378abf2eab562ab759513d09bc256

Changed in swift:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in swift:
milestone: none → 2.3.0-rc1
status: Fix Committed → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/crypto)

Fix proposed to branch: feature/crypto
Review: https://review.openstack.org/175866

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (feature/crypto)
Download full text (39.4 KiB)

Reviewed: https://review.openstack.org/175866
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=5bb7c286ebb4a54e4d2bd5a02845644d1c651183
Submitter: Jenkins
Branch: feature/crypto

commit e440d6aed8a40848584767ed36811bf09c738838
Author: Kota Tsuyuzaki <email address hidden>
Date: Wed Apr 15 11:25:13 2015 -0700

    Fix best response to return correct status

    Current best response could return "503 Internal Server Error".
    However, "503" means "Service Unavailable". (The status int of
    Internal Server Error is 500)

    This patch fixes the response status as "503 Service Unavailable"

    Change-Id: I88b8c52c26b19e9e76ba3375f1e16ced555ed54c

commit 57011d5699d49a47ae89073ff27b39140ab4d652
Author: Ricardo Ferreira <email address hidden>
Date: Thu Mar 12 23:18:33 2015 +0000

    More user-friendly output for object metadata

    Split out system, user and other metadata in swift-object-info. Print
    every position line by line instead of raw dict representation, so it
    would be easier to parse with tools such as grep.

    Co-Authored-By: Ricardo Ferreira <email address hidden>
    Co-Authored-By: Kamil Rykowski <email address hidden>

    Change-Id: Ia78da518c18f7e26016700aee87efb534fbd2040
    Closes-Bug: #1428866

commit a162c2bdd7be12daa29dd07230f84efcaf1cab37
Author: OpenStack Proposal Bot <email address hidden>
Date: Thu Apr 16 06:06:35 2015 +0000

    Imported Translations from Transifex

    For more information about this automatic import see:
    https://wiki.openstack.org/wiki/Translations/Infrastructure

    Change-Id: I48ba06f4801ff2d7856d67e74d2b1f76c550fcf4

commit 52b102163e48dc04a6a492a3430efa1f7778d7ec
Author: Clay Gerrard <email address hidden>
Date: Wed Apr 15 15:31:06 2015 -0700

    Don't apply the wrong Etag validation to rebuilt fragments

    Because of the object-server's interaction with ssync sender's
    X-Backend-Replication-Headers when a object (or fragment archive) is
    pushed unmodified to another node it's ETag value is duped into the
    recieving ends metadata as Etag. This interacts poorly with the
    reconstructor's RebuildingECDiskFileStream which can not know ahead of
    time the ETag of the fragment archive being rebuilt.

    Don't send the Etag from the local source fragment archive being used as
    the basis for the rebuilt fragent archive's metadata along to ssync.

    Change-Id: Ie59ad93a67a7f439c9a84cd9cff31540f97f334a

commit 46bd6716ffae28aef53f15af170fd2df01b49843
Author: Kota Tsuyuzaki <email address hidden>
Date: Tue Apr 14 23:22:14 2015 -0700

    Small minor refactor on ec diskfile

    To be more helpful, add an inline comment and remove
    unnecessary assignment.

    Change-Id: Ia9c6993dfa03c238736955de8b0f5c1a7d5d1b65

commit 193fe9a5f906a2344bb5d328ad55b881e4086caa
Author: Lorcan <email address hidden>
Date: Wed Apr 15 11:32:32 2015 +0100

    Update swift-recon doc with more options

    The swit-recon tool has had several functional additions
    added recently but not all of these have been added to the docs.

    This change add...

Thierry Carrez (ttx)
Changed in swift:
milestone: 2.3.0-rc1 → 2.3.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.