Browse Source

Adds a whitelist for endpoint catalog substitution

Change-Id: If02327d70d0143d805969fe927898f08eb84c4c2
Closes-Bug: #1354208
tags/2014.2.rc1
David Stanek 5 years ago
parent
commit
2989ff257e
5 changed files with 55 additions and 0 deletions
  1. +7
    -0
      etc/keystone.conf.sample
  2. +4
    -0
      keystone/catalog/core.py
  3. +11
    -0
      keystone/common/config.py
  4. +12
    -0
      keystone/common/utils.py
  5. +21
    -0
      keystone/tests/unit/catalog/test_core.py

+ 7
- 0
etc/keystone.conf.sample View File

@@ -555,6 +555,13 @@
# catalog collection. (integer value)
#list_limit=<None>

# (Deprecated) List of possible substitutions for use in
# formatting endpoints. Use caution when modifying this list.
# It will give users with permission to create endpoints the
# ability to see those values in your configuration file. This
# option will be removed in Juno. (list value)
#endpoint_substitution_whitelist=tenant_id,user_id,public_bind_host,admin_bind_host,compute_host,compute_port,admin_port,public_port,public_endpoint,admin_endpoint


[credential]


+ 4
- 0
keystone/catalog/core.py View File

@@ -23,6 +23,7 @@ from keystone.common import cache
from keystone.common import dependency
from keystone.common import driver_hints
from keystone.common import manager
from keystone.common import utils
from keystone import config
from keystone import exception
from keystone.i18n import _
@@ -46,6 +47,9 @@ def format_url(url, substitutions):
:returns: a formatted URL

"""
substitutions = utils.WhiteListedItemFilter(
CONF.catalog.endpoint_substitution_whitelist,
substitutions)
try:
result = url.replace('$(', '%(') % substitutions
except AttributeError:

+ 11
- 0
keystone/common/config.py View File

@@ -792,6 +792,17 @@ FILE_OPTIONS = {
cfg.IntOpt('list_limit',
help='Maximum number of entities that will be returned '
'in a catalog collection.'),
cfg.ListOpt('endpoint_substitution_whitelist',
default=['tenant_id', 'user_id', 'public_bind_host',
'admin_bind_host', 'compute_host', 'compute_port',
'admin_port', 'public_port', 'public_endpoint',
'admin_endpoint'],
help='(Deprecated) List of possible substitutions for use '
'in formatting endpoints. Use caution when modifying '
'this list. It will give users with permission to '
'create endpoints the ability to see those values '
'in your configuration file. This option will be '
'removed in Juno.'),
],
'kvs': [
cfg.ListOpt('backends', default=[],

+ 12
- 0
keystone/common/utils.py View File

@@ -526,3 +526,15 @@ def make_dirs(path, mode=None, user=None, group=None, log=None):
raise EnvironmentError("makedirs('%s'): %s" % (path, exc.strerror))

set_permissions(path, mode, user, group, log)


class WhiteListedItemFilter(object):

def __init__(self, whitelist, data):
self._whitelist = set(whitelist or [])
self._data = data

def __getitem__(self, name):
if name not in self._whitelist:
raise KeyError
return self._data[name]

+ 21
- 0
keystone/tests/unit/catalog/test_core.py View File

@@ -10,14 +10,26 @@
# License for the specific language governing permissions and limitations
# under the License.

from oslo.config import fixture as config_fixture
import testtools

from keystone.catalog import core
from keystone import config
from keystone import exception


CONF = config.CONF


class FormatUrlTests(testtools.TestCase):

def setUp(self):
super(FormatUrlTests, self).setUp()
fixture = self.useFixture(config_fixture.Config(CONF))
fixture.config(
group='catalog',
endpoint_substitution_whitelist=['host', 'port', 'part1', 'part2'])

def test_successful_formatting(self):
url_template = 'http://%(host)s:%(port)d/%(part1)s/%(part2)s'
values = {'host': 'server', 'port': 9090, 'part1': 'A', 'part2': 'B'}
@@ -53,3 +65,12 @@ class FormatUrlTests(testtools.TestCase):

_test(None)
_test(object())

def test_substitution_with_key_not_whitelisted(self):
url_template = 'http://%(host)s:%(port)d/%(part1)s/%(part2)s/%(part3)s'
values = {'host': 'server', 'port': 9090,
'part1': 'A', 'part2': 'B', 'part3': 'C'}
self.assertRaises(exception.MalformedEndpoint,
core.format_url,
url_template,
values)

Loading…
Cancel
Save