Able to show update and delete aggregate with invalid id

Bug #1865040 reported by GEET JAIN
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Undecided
Johannes Kulik
Pike
New
Undecided
Unassigned
Queens
New
Undecided
Unassigned
Rocky
New
Undecided
Unassigned
Stein
Fix Released
Undecided
Unassigned
Train
Fix Released
Undecided
Unassigned

Bug Description

Description
===========
Able to show, update and delete the aggregate with invalid id. Invalid id means it will start with the same id but appended with some alphanumeric string(ex - actual_id: 5 invalid_id: 5abcd or invalid_id: 5abcd123).

This issue is only with actual_id appended with alphanumeric value started with alphabets not with numbers.

The aggregate id which is being received on routes is not converting to integer anywhere in the code and later it gets transfer to db , which truncates the appended string with original id -

ex below warning -

/usr/local/lib/python2.7/dist-packages/pymysql/cursors.py:166: Warning: (1292, u"Truncated incorrect DOUBLE value: '6abcd123'")

There are ways to change the setting and convert the warning into error but the code should handle such situation and raise an exception with proper error message.

Steps to reproduce
==================

1. Create an aggregate -

+----+----------+-------------------+
| ID | Name | Availability Zone |
+----+----------+-------------------+
| 5 | new_name | None |
+----+----------+-------------------+

2. Get the above created aggregate with a wrong id Ex - 5abcd (started with correct id but appended with some alphabets)

curl -g -i -X GET http://192.168.56.5:8774/v2.1/os-aggregates/5abcd -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: $TOKEN"HTTP/1.1 200 OK
Content-Length: 226
Content-Type: application/json
Openstack-Api-Version: compute 2.1
X-Openstack-Nova-Api-Version: 2.1
Vary: OpenStack-API-Version
Vary: X-OpenStack-Nova-API-Version
X-Compute-Request-Id: req-c76d66ad-c4ce-430a-bcd5-a5ec5e962d2e
Date: Thu, 27 Feb 2020 13:44:07 GMT

{"aggregate": {"name": "new_name", "availability_zone": null, "deleted": false, "created_at": "2020-02-27T13:34:00.000000", "updated_at": "2020-02-27T13:41:14.000000", "hosts": [], "deleted_at": null, "id": 5, "metadata": {}}}stack@a:~/nova/nova/api/openstack/compute$

3. Update the above created aggregate with a wrong id Ex - 5abcd (started with correct id but appended with some alphabets) -

Response (0.169s) - http://192.168.56.5:8774/v2.1/os-aggregates/5abcd
200 OK

{
  "aggregate": {
    "name": "new_updated",
    "availability_zone": null,
    "deleted": false,
    "created_at": "2020-02-27T13:34:00.000000",
    "updated_at": "2020-02-27T13:45:17.542075",
    "hosts": [],
    "deleted_at": null,
    "id": 5,
    "metadata": {}
  }
}

4. Delete the above created aggregate with a wrong id Ex - 5abcd (started with correct id but appended with some alphabets) -

curl -g -i -X DELETE http://192.168.56.5:8774/v2.1/os-aggregates/5abcd -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: $TOKEN"
HTTP/1.1 200 OK
Content-Length: 0
Content-Type: application/json
Openstack-Api-Version: compute 2.1
X-Openstack-Nova-Api-Version: 2.1
Vary: OpenStack-API-Version
Vary: X-OpenStack-Nova-API-Version
X-Compute-Request-Id: req-8d4a2d57-934b-4c66-9a48-9e114b1b4e9f
Date: Thu, 27 Feb 2020 13:46:10 GMT

Expected result
===============
Show, update and delete should not work for invalid id (mentioned in summary).

Actual result
=============
Show, update and delete is working for invalid id (mentioned in summary).

Environment
===========
1. Openstack Release - Ocata
2. Hypervisor - QEMU

Revision history for this message
GEET JAIN (geet123jain) wrote :
Revision history for this message
GEET JAIN (geet123jain) wrote :

Will be trying to fix this.

Changed in nova:
assignee: nobody → GEET JAIN (geet123jain)
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.opendev.org/710290

Changed in nova:
assignee: GEET JAIN (geet123jain) → Johannes Kulik (jkulik)
Revision history for this message
Johannes Kulik (jkulik) wrote :

The other change will get abandoned in favor of https://review.opendev.org/#/c/710214/ as both were created at nearly the same time.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on nova (master)

Change abandoned by GEET JAIN (<email address hidden>) on branch: master
Review: https://review.opendev.org/710290
Reason: Abandon the change in favor of https://review.opendev.org/#/c/710214/ as both were created at nearly the same time.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.opendev.org/710214
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=2e70a1717f25652912886cbefa3f40e6df908c00
Submitter: Zuul
Branch: master

commit 2e70a1717f25652912886cbefa3f40e6df908c00
Author: Johannes Kulik <email address hidden>
Date: Thu Feb 27 08:08:32 2020 +0100

    Validate id as integer for os-aggregates

    According to the api-ref, the id passed to calls in os-aggregates is
    supposed to be an integer. No function validated this, so any value
    passed to these functions would directly reach the DB. While this is
    fine for SQLite, making a query with a string for an integer column on
    other databases like PostgreSQL results in a DBError exception and thus
    a HTTP 500 instead of 400 or 404.

    This commit adds validation for the id parameter the same way it's
    already done for other endpoints.

    Closes-Bug: 1865040

    Change-Id: I83817f7301680801beaee375825f02eda526eda1

Changed in nova:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/nova 20.5.0

This issue was fixed in the openstack/nova 20.5.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (stable/stein)

Reviewed: https://review.opendev.org/c/openstack/nova/+/764308
Committed: https://opendev.org/openstack/nova/commit/9448291d8f3ff6bef85d3bca4aa21c1e6036b3f1
Submitter: "Zuul (22348)"
Branch: stable/stein

commit 9448291d8f3ff6bef85d3bca4aa21c1e6036b3f1
Author: Johannes Kulik <email address hidden>
Date: Thu Feb 27 08:08:32 2020 +0100

    Validate id as integer for os-aggregates

    According to the api-ref, the id passed to calls in os-aggregates is
    supposed to be an integer. No function validated this, so any value
    passed to these functions would directly reach the DB. While this is
    fine for SQLite, making a query with a string for an integer column on
    other databases like PostgreSQL results in a DBError exception and thus
    a HTTP 500 instead of 400 or 404.

    This commit adds validation for the id parameter the same way it's
    already done for other endpoints.

    Change-Id: I83817f7301680801beaee375825f02eda526eda1
    Closes-Bug: 1865040
    (cherry picked from commit 2e70a1717f25652912886cbefa3f40e6df908c00)
    (cherry picked from commit 4653245ddcf989ebac4b964a41d881d78cf9ae2c)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on nova (stable/pike)

Change abandoned by "Elod Illes <email address hidden>" on branch: stable/pike
Review: https://review.opendev.org/c/openstack/nova/+/764479
Reason: stable/pike has transitioned to End of Life for nova, open patches need to be abandoned in order to be able to delete the branch.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on nova (stable/queens)

Change abandoned by "Elod Illes <email address hidden>" on branch: stable/queens
Review: https://review.opendev.org/c/openstack/nova/+/764310
Reason: This branch transitioned to End of Life for this project, open patches needs to be closed to be able to delete the branch.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/nova stein-eol

This issue was fixed in the openstack/nova stein-eol release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on nova (stable/rocky)

Change abandoned by "Elod Illes <email address hidden>" on branch: stable/rocky
Review: https://review.opendev.org/c/openstack/nova/+/764309
Reason: This branch transitioned to End of Life for this project, open patches needs to be closed to be able to delete the branch.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.