copy middleware stores per-request data on the WSGI filter

Bug #1774719 reported by Tim Burke
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
Fix Released
Undecided
Unassigned

Bug Description

In __call__ we assign self.account_name, self.container_name, and self.object_name [1] based on the request, but by the time we *use* them [2], another request may have come in and overwritten it.

The good news is, all subrequests are authorized normally, so this *shouldn't* have an security implications -- but if a user issues several concurrent COPYs for which they *are* authorized, we aren't necessarily copying the correct data for them!

Note that it looks like *only* the COPY verb is affected.

[1] https://github.com/openstack/swift/blob/2.18.0/swift/common/middleware/copy.py#L251-L253
[2] https://github.com/openstack/swift/blob/2.18.0/swift/common/middleware/copy.py#L279-L289

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (master)

Reviewed: https://review.openstack.org/571903
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=9ef2a828166aece6b374a97b0777b90c359fdebd
Submitter: Zuul
Branch: master

commit 9ef2a828166aece6b374a97b0777b90c359fdebd
Author: Tim Burke <email address hidden>
Date: Wed May 30 15:52:16 2018 -0700

    copy: Stop hanging per-request data on middleware instance

    Change-Id: Ib7b208669e900b84a7759819ef76b7b5b7ce8c9a
    Closes-Bug: 1774719

Changed in swift:
status: New → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/swift 2.19.0

This issue was fixed in the openstack/swift 2.19.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (stable/queens)

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/624516

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (stable/pike)

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/624527

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (stable/ocata)

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/628276

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (stable/pike)

Reviewed: https://review.openstack.org/624527
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=68fc87ad21d63c713ed13aeb6a214357d2d61dd6
Submitter: Zuul
Branch: stable/pike

commit 68fc87ad21d63c713ed13aeb6a214357d2d61dd6
Author: Tim Burke <email address hidden>
Date: Wed May 30 15:52:16 2018 -0700

    copy: Stop hanging per-request data on middleware instance

    Change-Id: Ib7b208669e900b84a7759819ef76b7b5b7ce8c9a
    Closes-Bug: 1774719
    (cherry picked from commit 9ef2a828166aece6b374a97b0777b90c359fdebd)

tags: added: in-stable-pike
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (stable/queens)

Reviewed: https://review.openstack.org/624516
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=c5524aed117ef8fcf0c961ae6bde5c13786dbd83
Submitter: Zuul
Branch: stable/queens

commit c5524aed117ef8fcf0c961ae6bde5c13786dbd83
Author: Tim Burke <email address hidden>
Date: Wed May 30 15:52:16 2018 -0700

    copy: Stop hanging per-request data on middleware instance

    Change-Id: Ib7b208669e900b84a7759819ef76b7b5b7ce8c9a
    Closes-Bug: 1774719
    (cherry picked from commit 9ef2a828166aece6b374a97b0777b90c359fdebd)

tags: added: in-stable-queens
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (stable/ocata)

Reviewed: https://review.openstack.org/628276
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=e58b70cac933e80fe6a595badb95e819cc9f396c
Submitter: Zuul
Branch: stable/ocata

commit e58b70cac933e80fe6a595badb95e819cc9f396c
Author: Tim Burke <email address hidden>
Date: Wed May 30 15:52:16 2018 -0700

    copy: Stop hanging per-request data on middleware instance

    Change-Id: Ib7b208669e900b84a7759819ef76b7b5b7ce8c9a
    Closes-Bug: 1774719
    (cherry picked from commit 9ef2a828166aece6b374a97b0777b90c359fdebd)

tags: added: in-stable-ocata
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/swift 2.15.2

This issue was fixed in the openstack/swift 2.15.2 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/swift 2.17.1

This issue was fixed in the openstack/swift 2.17.1 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/swift ocata-eol

This issue was fixed in the openstack/swift ocata-eol release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.