openstack/deb-ceilometer
Code Issues Proposed changes

Do not default pecan_debug to CONF.debug

Browse Source 
Pecan's debug mode can be terribly insecure; 500 errors return a
Python traceback, the full list of environment variables, and a
button to replay the request with a breakpoint.

Deployers often run OpenStack services in debug mode; doing so should
not open the service up to these flaws. Defaulting pecan_debug to
CONF.debug makes this easy to accidentally do. So, default it to False
rather than riding on top of CONF.debug.

Change-Id: I70f9c9807d16aa50df4d5e16ba2a29575f8b165e
Closes-Bug: #1425206
DocImpact
This commit is contained in:
Jim Rollenhagen 2015-02-24 21:56:53 +00:00
parent 372e8070d5
commit b2a21fba08
2 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ceilometer/api/app.py
View File

@ -46,9 +46,8 @@ OPTS = [
API_OPTS = [ API_OPTS = [
cfg.BoolOpt('pecan_debug', cfg.BoolOpt('pecan_debug',
help='Toggle Pecan Debug Middleware. ' default=False,
'If it is not set, global debug value will be used.' help='Toggle Pecan Debug Middleware.'),
),
] ]
CONF.register_opts(OPTS) CONF.register_opts(OPTS)
@ -78,8 +77,6 @@ def setup_app(pecan_config=None, extra_hooks=None):
pecan.configuration.set_config(dict(pecan_config), overwrite=True) pecan.configuration.set_config(dict(pecan_config), overwrite=True)
cfg.set_defaults(API_OPTS, pecan_debug=CONF.debug)
# NOTE(sileht): pecan debug won't work in multi-process environment # NOTE(sileht): pecan debug won't work in multi-process environment
pecan_debug = CONF.api.pecan_debug pecan_debug = CONF.api.pecan_debug
if service.get_workers('api') != 1 and pecan_debug: if service.get_workers('api') != 1 and pecan_debug:

2
ceilometer/tests/api/test_app.py
View File

@ -50,7 +50,7 @@ class TestApp(base.BaseTestCase):
self.assertEqual(expected, kwargs.get('debug')) self.assertEqual(expected, kwargs.get('debug'))
_check_pecan_debug(g_debug=False, p_debug=None, expected=False) _check_pecan_debug(g_debug=False, p_debug=None, expected=False)
_check_pecan_debug(g_debug=True, p_debug=None, expected=True) _check_pecan_debug(g_debug=True, p_debug=None, expected=False)
_check_pecan_debug(g_debug=True, p_debug=False, expected=False) _check_pecan_debug(g_debug=True, p_debug=False, expected=False)
_check_pecan_debug(g_debug=False, p_debug=True, expected=True) _check_pecan_debug(g_debug=False, p_debug=True, expected=True)
_check_pecan_debug(g_debug=True, p_debug=None, expected=False, _check_pecan_debug(g_debug=True, p_debug=None, expected=False,