yahoo-eng-team team mailing list archive

[Mykola Yakovliev <1855776@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

Description
===========
Nova API's aggregate ID lookup does not require an exact match.  Alphanumeric strings can possibly be truncated and converted to integers incorrectly.

Steps to reproduce
==================
Determine the ID of an existing aggregate.

Take the aggregate ID, and append junk data to it, ensuring that the
digit following the actual ID is an alphabetic character.e.g. aggregate
id = '13', the test string would be something like '13a2g152asdf'Send a
PUT request to '<NOVA API>/os_aggregates/<modified aggregate ID>,'
modifying either the name or availability zone

Check for whether or not the server returns an error (aggregate ID not found), or a 200 OK indicating the change was successful.
Successful change indicates the issue still exists.

Expected result
===============
Nova should return error.

Actual result
=============
Nova returns 200.

** Affects: nova
     Importance: Undecided
     Assignee: Mykola Yakovliev (vegasq)
         Status: In Progress

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1855776

Title:
  Aggregate ID validation

Status in OpenStack Compute (nova):
  In Progress

Bug description:
  Description
  ===========
  Nova API's aggregate ID lookup does not require an exact match.  Alphanumeric strings can possibly be truncated and converted to integers incorrectly.

  Steps to reproduce
  ==================
  Determine the ID of an existing aggregate.

  Take the aggregate ID, and append junk data to it, ensuring that the
  digit following the actual ID is an alphabetic character.e.g.
  aggregate id = '13', the test string would be something like
  '13a2g152asdf'Send a PUT request to '<NOVA
  API>/os_aggregates/<modified aggregate ID>,' modifying either the name
  or availability zone

  Check for whether or not the server returns an error (aggregate ID not found), or a 200 OK indicating the change was successful.
  Successful change indicates the issue still exists.

  Expected result
  ===============
  Nova should return error.

  Actual result
  =============
  Nova returns 200.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1855776/+subscriptions