)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5cc731526a90b181d43dd994c7c35b04c80e2d0b","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"During the Stein PTG there was a session to discuss ways to make it"},{"line_number":10,"context_line":"easier to ensure we can change policies without breakages. Ideally,"},{"line_number":11,"context_line":"having a series of test classes than ensure the policy being using to"},{"line_number":12,"context_line":"protect an API is exercised using the oslo.context and olso.policy"},{"line_number":13,"context_line":"libraries."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f79a3b5_f241da0b","line":11,"range":{"start_line":11,"start_character":32,"end_line":11,"end_character":36},"updated":"2018-09-14 19:21:37.000000000","message":"that*","commit_id":"e11577e15265d8ac48c9512442fe899444b368d2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5cc731526a90b181d43dd994c7c35b04c80e2d0b","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"During the Stein PTG there was a session to discuss ways to make it"},{"line_number":10,"context_line":"easier to ensure we can change policies without breakages. Ideally,"},{"line_number":11,"context_line":"having a series of test classes than ensure the policy being using to"},{"line_number":12,"context_line":"protect an API is exercised using the oslo.context and olso.policy"},{"line_number":13,"context_line":"libraries."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f79a3b5_9248a62e","line":11,"range":{"start_line":11,"start_character":61,"end_line":11,"end_character":66},"updated":"2018-09-14 19:21:37.000000000","message":"used*","commit_id":"e11577e15265d8ac48c9512442fe899444b368d2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5cc731526a90b181d43dd994c7c35b04c80e2d0b","unresolved":false,"context_lines":[{"line_number":9,"context_line":"During the Stein PTG there was a session to discuss ways to make it"},{"line_number":10,"context_line":"easier to ensure we can change policies without breakages. Ideally,"},{"line_number":11,"context_line":"having a series of test classes than ensure the policy being using to"},{"line_number":12,"context_line":"protect an API is exercised using the oslo.context and olso.policy"},{"line_number":13,"context_line":"libraries."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"This commit attempts to build out a set of example test cases that can"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f79a3b5_d23e1e8a","line":12,"range":{"start_line":12,"start_character":55,"end_line":12,"end_character":59},"updated":"2018-09-14 19:21:37.000000000","message":"oslo","commit_id":"e11577e15265d8ac48c9512442fe899444b368d2"}],"cinder/tests/unit/api/v3/test_volume_protection.py":[{"author":{"_account_id":27615,"name":"Rajat Dhasmana","email":"rajatdhasmana@gmail.com","username":"whoami-rajat"},"change_message_id":"047fa4c7617d7b4f3bf4af6b983fa49af8482b68","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        volume \u003d self._create_fake_volume(admin_context)"},{"line_number":49,"context_line":"        mock_volume.return_value \u003d volume"},{"line_number":50,"context_line":"        request \u003d webob.Request.blank(\u0027/v3/volumes/%s\u0027 % volume.id)"},{"line_number":51,"context_line":"        request.content_type \u003d \u0027application/json\u0027"},{"line_number":52,"context_line":"        request.headers \u003d mv.get_mv_header(mv.BASE_VERSION)"},{"line_number":53,"context_line":"        request.method \u003d \u0027GET\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_ba97c545","line":50,"updated":"2018-09-14 10:29:53.000000000","message":"The request url seems invalid that\u0027s why 404 is returned instead of 200.\nRefer here\nhttps://developer.openstack.org/api-ref/block-storage/v3/#show-a-volume-s-details","commit_id":"f5f0a5ee37ae54d07679ce27fd8beccbbc58f68b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"58ea413a0b3d0673ae4c5cfcf95382ac636cea68","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        volume \u003d self._create_fake_volume(admin_context)"},{"line_number":49,"context_line":"        mock_volume.return_value \u003d volume"},{"line_number":50,"context_line":"        request \u003d webob.Request.blank(\u0027/v3/volumes/%s\u0027 % volume.id)"},{"line_number":51,"context_line":"        request.content_type \u003d \u0027application/json\u0027"},{"line_number":52,"context_line":"        request.headers \u003d mv.get_mv_header(mv.BASE_VERSION)"},{"line_number":53,"context_line":"        request.method \u003d \u0027GET\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_6ac39c39","line":50,"in_reply_to":"3f79a3b5_ba97c545","updated":"2018-09-14 15:02:36.000000000","message":"Aha - nice. Thanks, Rajat!\n\nI guess I was looking at another example in the tests? I\u0027ll see if your suggestion gets me further.\n\nhttps://github.com/openstack/cinder/blob/master/cinder/tests/unit/api/v3/test_volumes.py#L65-L66","commit_id":"f5f0a5ee37ae54d07679ce27fd8beccbbc58f68b"},{"author":{"_account_id":1736,"name":"Ivan Kolodyazhny","email":"e0ne@e0ne.info","username":"e0ne"},"change_message_id":"7e0156668d3d5a4b416e09052d8ed563674f6659","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        )"},{"line_number":112,"context_line":"        # NOTE(lbragstad): Technically, this user isn\u0027t supposed to see this"},{"line_number":113,"context_line":"        # volume, because they didn\u0027t create it and it lives in a different"},{"line_number":114,"context_line":"        # project. Does cinder return a 404 in cases like this? Or is a 403"},{"line_number":115,"context_line":"        # expected?"},{"line_number":116,"context_line":"        self.assertEqual(http_client.NOT_FOUND, response.status_int)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_e2bf4cc7","line":114,"range":{"start_line":114,"start_character":17,"end_line":114,"end_character":63},"updated":"2018-09-21 09:21:31.000000000","message":"AFAIR, it was done in a such way for a security reasons to not allow users get volume ID from other projects","commit_id":"530fb9319ce21b7ff99e55f095c04f13f0785842"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e49d3cf561a66c167fa74d6798d22dd5fd99ab9e","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        )"},{"line_number":112,"context_line":"        # NOTE(lbragstad): Technically, this user isn\u0027t supposed to see this"},{"line_number":113,"context_line":"        # volume, because they didn\u0027t create it and it lives in a different"},{"line_number":114,"context_line":"        # project. Does cinder return a 404 in cases like this? Or is a 403"},{"line_number":115,"context_line":"        # expected?"},{"line_number":116,"context_line":"        self.assertEqual(http_client.NOT_FOUND, response.status_int)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_6cd24a36","line":114,"range":{"start_line":114,"start_character":17,"end_line":114,"end_character":63},"in_reply_to":"3f79a3b5_b1f8bc49","updated":"2018-09-21 15:06:09.000000000","message":"Aha - ok, that\u0027s fair. I guess it boils down to the order of processing information.\n\nIf a policy check requires attributes of a resource, safe processing would be:\n\n1. query backend for the resource in question\n2. process the attributes of the resource (e.g., comparing the project_id of the resource against the project_id of the user\u0027s token)\n\nIf step 1 fails because the resource doesn\u0027t exist, return 403 for opaqueness, which limits the ability for bad actors to guess volume IDs. If a bad actor gets a 403 instead of a 404, then they know that they have the volume ID. If step 2 fails, when we should return a 403, too.\n\nIf the user is guessing at volume IDs and we haven\u0027t authorized them, then we could give them a 403. If a user is authorized to access an API and a resource doesn\u0027t exist, we can safely return a 404, right?","commit_id":"530fb9319ce21b7ff99e55f095c04f13f0785842"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7862b371bbe33f80303133683fed1a1c85045233","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        )"},{"line_number":112,"context_line":"        # NOTE(lbragstad): Technically, this user isn\u0027t supposed to see this"},{"line_number":113,"context_line":"        # volume, because they didn\u0027t create it and it lives in a different"},{"line_number":114,"context_line":"        # project. Does cinder return a 404 in cases like this? Or is a 403"},{"line_number":115,"context_line":"        # expected?"},{"line_number":116,"context_line":"        self.assertEqual(http_client.NOT_FOUND, response.status_int)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_b1f8bc49","line":114,"range":{"start_line":114,"start_character":17,"end_line":114,"end_character":63},"in_reply_to":"3f79a3b5_e2bf4cc7","updated":"2018-09-21 13:14:48.000000000","message":"FWIW, Nova does very similar things for the same reason.","commit_id":"530fb9319ce21b7ff99e55f095c04f13f0785842"}]}