Payload content type is only partially validated if a payload isn't specified

Bug #1376490 reported by John Vrbanac
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Barbican
Fix Released
Medium
Juan Antonio Osorio Robles

Bug Description

Currently, if a user only specifies a payload_content_type without a payload, the attribute is only partially validated and doesn't determine if the attribute content is one of the appropriate values.

If a user specifies a payload_content_type it should be properly validated.

Steps to Replicate:

curl -X POST -H "X-Auth-Token:$AUTH_TOKEN" -H "Content-Type:application/json" -H "X-Project-Id:$PROJECT_ID" -d '{
  "type": "key",
  "meta": {
    "mode": "cbc",
    "bit_length": 256,
    "name": "secretname",
    "algorithm": "aes",
    "payload_content_type": "blarg!"
  }
}' http://localhost:9311/v1/orders

Actual Response:
200 OK
{
    "order_ref": "http://localhost:9311/v1/orders/cbb189f5-0da4-480b-b04b-e2dae1dc0911"
}

Expected Response:
400 Bad Request
{
    "code": 400,
    "description": "Provided object does not match schema 'Secret' within 'Order': payload_content_type is not one of ['text/plain', 'text/plain;charset=utf-8', 'text/plain; charset=utf-8', 'application/octet-stream']",
    "title": "Bad Request"
}

Revision history for this message
John Wood (john-wood-w) wrote :

Hello John, per the API doc if the 'payload' is not specified, the 'payload_content_type' and 'payload_content_encoding' fields are ignored: https://github.com/cloudkeep/barbican/wiki/Application-Programming-Interface#two-step-binary-secret-createretrieve

So I think this 'functions as designed', but perhaps the API should me modified to reject attempts to set those attributes if 'payload' is not specified? Worth bringing up at summit?

Revision history for this message
John Vrbanac (john.vrbanac) wrote :

I would agree that they are ignored as in they will not be used. However, that doesn't mean that if someone provides information that we shouldn't validate the information. It seems odd to fully validate some optional attributes, but not others.

Revision history for this message
Paul Kehrer (paul-l-kehrer) wrote :

I agree that if it's passed we should validate it (if only because that's easy for us to do and we essentially have to do it when we use it anyway).

Changed in barbican:
status: New → Confirmed
Changed in barbican:
importance: Undecided → Medium
Changed in barbican:
assignee: nobody → Juan Antonio Osorio Robles (juan-osorio-robles)
Revision history for this message
Juan Antonio Osorio Robles (juan-osorio-robles) wrote :

John, is the response that you put as what's going on correct? shouldn't it be a 202?

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to barbican (master)

Fix proposed to branch: master
Review: https://review.openstack.org/149570

Changed in barbican:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to barbican (master)

Reviewed: https://review.openstack.org/149570
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=b4a785be1d5c7a6c43f4aa0ba65a7147aa161f37
Submitter: Jenkins
Branch: master

commit b4a785be1d5c7a6c43f4aa0ba65a7147aa161f37
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Fri Jan 23 13:06:39 2015 +0200

    Fix content type validation if missing payload

    If no payload is provided, our API specifies that the payload's
    content type will be optional, but this doesn't mean that it will not
    be validated. This commit disables clients putting unsupported content
    types.

    Closes-Bug: #1376490
    Change-Id: I0836f30c8ea23eff515ff7d5f944f5cf85ebb5e8

Changed in barbican:
status: In Progress → Fix Committed
Changed in barbican:
milestone: none → kilo-2
Thierry Carrez (ttx)
Changed in barbican:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in barbican:
milestone: kilo-2 → 2015.1.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.