openstack/trove
Code Issues Proposed changes

Merge "Fixed format string vulnerability in reddwarf call to OpenstackException handler"

Browse Source
This commit is contained in:
Jenkins 2013-05-23 21:15:38 +00:00 committed by Gerrit Code Review
commit 9a2c9794a2
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
reddwarf/extensions/mysql/common.py
View File

@ -32,7 +32,11 @@ def populate_databases(dbs):
databases.append(mydb.serialize())
return databases
except ValueError as ve:
raise exception.BadRequest(str(ve))
# str(ve) contains user input and may include '%' which can cause a
# format str vulnerability. Escape the '%' to avoid this. This is
# okay to do since we're not using dict args here in any case.
safe_string = str(ve).replace('%', '%%')
raise exception.BadRequest(safe_string)
def populate_users(users):