Bug #1586079 “YaqlYamlLoader inherits from YamlLoader” : Series newton : Bugs : Murano

Serg Melikyan (smelikyan) on 2016-05-26

description:

updated

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-26:

#1

Patch for the murano-dashboard

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-26:

#2

dashboard.patch Edit (1.4 KiB, text/plain)

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#4

Confirmed for dashboard for mitaka, liberty and kilo

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#5

dashboard-mitaka.patch Edit (1.4 KiB, text/plain)

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#6

dashboard-liberty.patch Edit (1.4 KiB, text/plain)

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#7

dashboard-kilo.patch Edit (1.4 KiB, text/plain)

Revision history for this message

Tristan Cacqueray (tristan-cacqueray) wrote on 2016-05-27:

#8

Note that kilo isn't security supported anymore as it is eol. Otherwise the change looks good to me.

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#12

> Note that kilo isn't security supported anymore as it is eol. Otherwise the change looks good to me.

Indeed, seems that we in murano missed EOL for kilo, gotta catch up with that. Also — http://releases.openstack.org needs to be updated as it still says, that kilo is security supported.

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#13

Patches seem to work for me, but I would like to see reviews from other Cores of the project, preferably from Stan Lagun, to verify, that these patches do not accidentally break existing functionality

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-27:

#14

Stan pointed out, that we should also inherit from SafeConstructor instead of Coustructor, gotta add that to the patches to murano repository

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-30:

#15

murano.patch Edit (3.3 KiB, text/plain)

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-30:

#16

murano-mitaka.patch Edit (3.3 KiB, text/plain)

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-30:

#17

murano-liberty.patch Edit (3.3 KiB, text/plain)

Revision history for this message

Kirill Zaitsev (kzaitsev) wrote on 2016-05-30:

#18

murano-kilo.patch Edit (2.5 KiB, text/plain)

Revision history for this message

Stan Lagun (slagun) wrote on 2016-05-31:

#19

Looks good to me

Kirill Zaitsev (kzaitsev) on 2016-06-15

Changed in murano:
milestone:	newton-1 → newton-2

Kirill Zaitsev (kzaitsev) on 2016-06-23

information type:

Private Security → Public Security

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-06-23: Fix merged to murano-dashboard (master)

#20

Reviewed: https://review.openstack.org/333428
Committed: https://git.openstack.org/cgit/openstack/murano-dashboard/commit/?id=66ef3d71941c4bd672d1e8e37d8f7b199acd5462
Submitter: Jenkins
Branch: master

commit 66ef3d71941c4bd672d1e8e37d8f7b199acd5462
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 00:11:28 2016 +0300

Inherit custom yaml Loader from yaml.SafeLoader

    Before this patch yaql-enabled yaml Loader was inherited from yaml.Loader, that
    potentially allows creating arbitrary python objects from specifically
    formatted yaml tags. This could have happened whenever UI definitions of
    the package were processed.
    With this change yaql yaml-Loader no longer allows creating custom python objects.

Change-Id: I4fe38aa7e0fc567211ab872c7e1f8e81dbc3e765
Closes-Bug: #1586079

Changed in murano:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-06-23: Fix merged to murano (master)

#21

Reviewed: https://review.openstack.org/333423
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=28de8c36c9dbe4aaf4d062e6fb6099afd437f49b
Submitter: Jenkins
Branch: master

commit 28de8c36c9dbe4aaf4d062e6fb6099afd437f49b
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 00:42:38 2016 +0300

Use SafeLoader to load yaml files

    Before this patch yaml.Loader was used by the engine to create custom
    yaql-enabled yaml loader. It is unsafe do to so, because yaml.Loader is
    capable of creating custom python objects from specifically constructed
    yaml files.
    After this patch all yaml load operations are performed with safe
    loaders instead.
    Also uses SafeConstructor instead of Constructor.

Change-Id: I61a3c42d73608b5d013285f015a45f4774d264e3
Closes-Bug: #1586079

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-06-23: Fix merged to murano (stable/mitaka)

#22

Reviewed: https://review.openstack.org/333424
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=b03c4759aa40d66bd4fcf62c96e352c117bdf4b9
Submitter: Jenkins
Branch: stable/mitaka

commit b03c4759aa40d66bd4fcf62c96e352c117bdf4b9
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 00:42:38 2016 +0300

Use SafeLoader to load yaml files

    Before this patch yaml.Loader was used by the engine to create custom
    yaql-enabled yaml loader. It is unsafe do to so, because yaml.Loader is
    capable of creating custom python objects from specifically constructed
    yaml files.
    After this patch all yaml load operations are performed with safe
    loaders instead.
    Also use SafeConstructor instead of Constructor.

Change-Id: I61a3c42d73608b5d013285f015a45f4774d264e3
Closes-Bug: #1586079

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-06-23: Fix merged to murano (stable/liberty)

#23

Reviewed: https://review.openstack.org/333425
Committed: https://git.openstack.org/cgit/openstack/murano/commit/?id=355513fe2e8c929f783de1109bee76c340cedced
Submitter: Jenkins
Branch: stable/liberty

commit 355513fe2e8c929f783de1109bee76c340cedced
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 00:42:38 2016 +0300

Use SafeLoader to load yaml files

    Before this patch yaml.Loader was used by the engine to create custom
    yaql-enabled yaml loader. It is unsafe do to so, because yaml.Loader is
    capable of creating custom python objects from specifically constructed
    yaml files.
    After this patch all yaml load operations are performed with safe
    loaders instead.
    Also use SafeConstructor instead of Constructor.

Change-Id: I61a3c42d73608b5d013285f015a45f4774d264e3
Closes-Bug: #1586079

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-06-23: Fix merged to murano-dashboard (stable/mitaka)

#24

Reviewed: https://review.openstack.org/333439
Committed: https://git.openstack.org/cgit/openstack/murano-dashboard/commit/?id=338989020cfd2f4b16a71f7da9a788d668502c9e
Submitter: Jenkins
Branch: stable/mitaka

commit 338989020cfd2f4b16a71f7da9a788d668502c9e
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 00:11:28 2016 +0300

Inherit custom yaml Loader from yaml.SafeLoader

    Before this patch yaql-enabled yaml Loader was inherited from yaml.Loader, that
    potentially allows creating arbitrary python objects from specifically
    formatted yaml tags. This could have happened whenever UI definitions of
    the package were processed.
    With this change yaql yaml-Loader no longer allows creating custom python objects.

Change-Id: I4fe38aa7e0fc567211ab872c7e1f8e81dbc3e765
Closes-Bug: #1586079

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-06-23: Fix merged to murano-dashboard (stable/liberty)

#25

Reviewed: https://review.openstack.org/333432
Committed: https://git.openstack.org/cgit/openstack/murano-dashboard/commit/?id=0f3745415ab4f083cbf069a9cb574168e499a386
Submitter: Jenkins
Branch: stable/liberty

commit 0f3745415ab4f083cbf069a9cb574168e499a386
Author: Kirill Zaitsev <email address hidden>
Date: Fri May 27 00:11:28 2016 +0300

Inherit custom yaml Loader from yaml.SafeLoader

    Before this patch yaql-enabled yaml Loader was inherited from yaml.Loader, that
    potentially allows creating arbitrary python objects from specifically
    formatted yaml tags. This could have happened whenever UI definitions of
    the package were processed.
    With this change yaql yaml-Loader no longer allows creating custom python objects.

Change-Id: I4fe38aa7e0fc567211ab872c7e1f8e81dbc3e765
Closes-Bug: #1586079

Kirill Zaitsev (kzaitsev) on 2016-06-24

description:

updated

Revision history for this message

Doug Hellmann (doug-hellmann) wrote on 2016-06-27: Fix included in openstack/murano-dashboard 2.0.1

#26

This issue was fixed in the openstack/murano-dashboard 2.0.1 release.

Revision history for this message

Doug Hellmann (doug-hellmann) wrote on 2016-06-27: Fix included in openstack/murano 2.0.1

#27

This issue was fixed in the openstack/murano 2.0.1 release.

Revision history for this message

Doug Hellmann (doug-hellmann) wrote on 2016-06-27: Fix included in openstack/murano-dashboard 1.0.3

#28

This issue was fixed in the openstack/murano-dashboard 1.0.3 release.

Revision history for this message

Doug Hellmann (doug-hellmann) wrote on 2016-06-27: Fix included in openstack/murano 1.0.3

#29

This issue was fixed in the openstack/murano 1.0.3 release.

Revision history for this message

Davanum Srinivas (DIMS) (dims-v) wrote on 2016-07-15: Fix included in openstack/murano 3.0.0.0b2

#30

This issue was fixed in the openstack/murano 3.0.0.0b2 development milestone.

Revision history for this message

Davanum Srinivas (DIMS) (dims-v) wrote on 2016-07-15: Fix included in openstack/murano-dashboard 3.0.0.0b2

#31

This issue was fixed in the openstack/murano-dashboard 3.0.0.0b2 development milestone.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-11-10: Fix included in openstack/murano-dashboard 1.0.3

#32

This issue was fixed in the openstack/murano-dashboard 1.0.3 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2016-11-10: Fix included in openstack/murano 1.0.3

#33

This issue was fixed in the openstack/murano 1.0.3 release.

	Status	Importance	Assigned to	Milestone
Murano	Fix Released	Critical	Kirill Zaitsev	Murano newton-2 "n2"
Kilo	Won't Fix	Critical	Unassigned
Liberty	Fix Released	Critical	Kirill Zaitsev	Murano 1.0.x "1.0.x"
Mitaka	Fix Released	Critical	Kirill Zaitsev	Murano 2.0.x "2.0.x"
Newton	Fix Released	Critical	Kirill Zaitsev	Murano newton-2 "n2"

Murano

YaqlYamlLoader inherits from YamlLoader

Bug Description

CVE References

Other bug subscribers

Patches

Remote bug watches