octavia/releasenotes/notes/validate-url_path-value-in-requests-3eb3adedcd696433.yaml
Tom Weininger 251fab17b5 Reject invalid whitespace in HM url_path value
Plain whitespace characters in url_path must be rejected because
they may allow authorized users to inject arbitrary HAProxy
directives in the configuration of amphorae.

Story: 2008994
Task: 42656
Change-Id: I0f4c59a2928f2a813171109aaf73a1d7dff9eefe
2022-04-08 14:59:39 +02:00

8 lines
291 B
YAML

---
issues:
- |
Fixed configuration issue which allowed authenticated and authorized
users to inject code into HAProxy configuration using API requests.
Octavia API no longer accepts unencoded whitespace characters in url_path values
in update requests for healthmonitors.