OpenStack Object Storage (swift)

Overview
Code
Bugs
Blueprints
Translations
Answers

Bug #1453948
Comment #19

Comment 19 for bug 1453948

Revision history for this message

Alistair Coles (alistair-coles) wrote on 2015-08-05: Re: all PUT tempurls leak existence via DLO manifest attack

#19

anc-tempurl-dlo-POST-regression Edit (3.2 KiB, text/plain)

I'm +2 for the patch in #15

The tests do not cover POST requests. The fix does so there is no vulnerability with a POST but I think it would be worth adding a test to prevent a regression of the kind illustrated in the attached diff (diff wrt patch from #15). I can propose that to master after this fix is released.