)]}'
{"glance/api/middleware/context.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"56f224bbc7b99301c134d952befe40e79d15557f","unresolved":false,"context_lines":[{"line_number":117,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":118,"context_line":"                   CONF.max_request_id_length)"},{"line_number":119,"context_line":"            return webob.exc.HTTPRequestHeaderFieldsTooLarge(comment\u003dmsg)"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        kwargs \u003d {"},{"line_number":122,"context_line":"            \u0027user\u0027: req.headers.get(\u0027X-User-Id\u0027),"},{"line_number":123,"context_line":"            \u0027tenant\u0027: req.headers.get(\u0027X-Tenant-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_470a6a8b","line":120,"updated":"2015-08-07 07:12:04.000000000","message":"I am seeing two issues here,\n\n1. User can send same request-id from headers multiple times which will be difficult for tracking the failures.\n\n2. As request-id is accepted from headers user can send any garbage value like \u0027abcd324234\u0027 which will not be same as other request-ids like \u0027req-a26735a5-5687-4364-abcf-fe2924dedead\u0027","commit_id":"bff1d6fc204e8eba7642ee798462d11120ea1acb"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"ea6c81b68d661cd30cfb52291d41e5736b0737de","unresolved":false,"context_lines":[{"line_number":117,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":118,"context_line":"                   CONF.max_request_id_length)"},{"line_number":119,"context_line":"            return webob.exc.HTTPRequestHeaderFieldsTooLarge(comment\u003dmsg)"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        kwargs \u003d {"},{"line_number":122,"context_line":"            \u0027user\u0027: req.headers.get(\u0027X-User-Id\u0027),"},{"line_number":123,"context_line":"            \u0027tenant\u0027: req.headers.get(\u0027X-Tenant-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_bb27ac61","line":120,"in_reply_to":"1a4dcd0f_470a6a8b","updated":"2015-08-07 15:44:39.000000000","message":"1. doing that the user would just shoot oneself to the foot, so I do not see problem with that. Some times during the debugging of larger system that might even get beneficial\n\n2. what makes the first more garbage that the second? Neither of them is valuable under current scope (two pseudo random strings in middle of discussion) and when the request travels through the system it makes them both equally valuable when following the request paths through the logs. Monitoring, debugging and behaviour analysis on other hand becomes way easier when you can follow the environment by your pre known req-id.\n\nAnyways this discussion is not about the debate around if we allow one to send req-id to glance or not as that has been intention as long as I have been involved in the discussion and discussed and merged already. This is about if we give the admin possibility to limit the size outside of that 16384 default header line size or not.","commit_id":"bff1d6fc204e8eba7642ee798462d11120ea1acb"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"89b315009a4365ba44c87293541f0f43e6eeab0b","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if 0 \u003c CONF.max_request_id_length \u003c request_id.length:"},{"line_number":117,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":118,"context_line":"                   CONF.max_request_id_length)"},{"line_number":119,"context_line":"            return webob.exc.HTTPRequestHeaderFieldsTooLarge(comment\u003dmsg)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"1a4dcd0f_1648f7ca","line":117,"updated":"2015-08-07 16:09:08.000000000","message":"Naive question: Do we really want to disclose the configured size? Is it important for the user? If the user does things properly, it shouldn\u0027t get to this point. The user would get the request ID somewhere and use that.\n\nIf the limit is reached, then the user is trying things out of the normal workflow, which makes me thing we shouldn\u0027t disclose this information.","commit_id":"226fb0d4e75512431c6fd1b0628bb7d377ee7b91"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"158919422531b29535d2e421c5bce3191acf76ba","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if 0 \u003c CONF.max_request_id_length \u003c request_id.length:"},{"line_number":117,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":118,"context_line":"                   CONF.max_request_id_length)"},{"line_number":119,"context_line":"            return webob.exc.HTTPRequestHeaderFieldsTooLarge(comment\u003dmsg)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"1a4dcd0f_f85be8f4","line":117,"in_reply_to":"1a4dcd0f_1648f7ca","updated":"2015-08-07 22:36:38.000000000","message":"Does it make any sense not to and put the user to go to the trial and error?\n\nIt\u0027s not like we would be revealing any state secrets here, after all this is just to prevent having something ridiculously large dumping to logs. Like if someone wants to just find the max size to get maximum possible amount of data into the logs, not telling is not going to stop them o find out and for legit use case it\u0027s just bad experience.","commit_id":"226fb0d4e75512431c6fd1b0628bb7d377ee7b91"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"ec5e2207b89f97e39706261a50ad6d2957e8786d","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                       \u0027read-only privileges. This only applies when using \u0027"},{"line_number":40,"context_line":"                       \u0027ContextMiddleware.\u0027)),"},{"line_number":41,"context_line":"    cfg.IntOpt(\u0027max_request_id_length\u0027, default\u003d0,"},{"line_number":42,"context_line":"               help\u003d_(\u0027Limits request ID length.\u0027)),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_191eb5ba","line":42,"updated":"2015-08-18 10:11:30.000000000","message":"I would recommend to use min and max options here to restrict the range that the user can setup for this value:\nhttps://github.com/openstack/oslo.config/blob/master/oslo_config/cfg.py#L1023","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"7715b887eb736a4bbadaca6d92f192d33f6005d6","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                       \u0027read-only privileges. This only applies when using \u0027"},{"line_number":40,"context_line":"                       \u0027ContextMiddleware.\u0027)),"},{"line_number":41,"context_line":"    cfg.IntOpt(\u0027max_request_id_length\u0027, default\u003d0,"},{"line_number":42,"context_line":"               help\u003d_(\u0027Limits request ID length.\u0027)),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_947255ac","line":42,"in_reply_to":"fa1b9901_16b434cf","updated":"2015-08-19 09:09:18.000000000","message":"Again, I\u0027m not going to break our API (or let anyone else to do so) just to prevent deployer/user shooting themselves to foot. If you\u0027re too scared for such, maybe you shouldn\u0027t let that person near your deployment in the first place.\n\nPlease refer to the documentation for the documentation of the value and it\u0027s limits. Both the default value and the constraints have been explained there.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"d15303aae7643825daa23fe683afdd7936d82d47","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                       \u0027read-only privileges. This only applies when using \u0027"},{"line_number":40,"context_line":"                       \u0027ContextMiddleware.\u0027)),"},{"line_number":41,"context_line":"    cfg.IntOpt(\u0027max_request_id_length\u0027, default\u003d0,"},{"line_number":42,"context_line":"               help\u003d_(\u0027Limits request ID length.\u0027)),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_eb0f59df","line":42,"in_reply_to":"fa1b9901_191eb5ba","updated":"2015-08-18 14:10:10.000000000","message":"Why would we put min there? That would just break backwards compatibility for current behavior. And does not have anything to do with the vulnerability this change is to fix.\n\nWith actions like that we end up to same situation as Cinder and just break the API for someone else because we did not think. Rather not.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"0d2eb8ca2e0da88f909eb1aeb441cb0f2be89731","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                       \u0027read-only privileges. This only applies when using \u0027"},{"line_number":40,"context_line":"                       \u0027ContextMiddleware.\u0027)),"},{"line_number":41,"context_line":"    cfg.IntOpt(\u0027max_request_id_length\u0027, default\u003d0,"},{"line_number":42,"context_line":"               help\u003d_(\u0027Limits request ID length.\u0027)),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_ec542522","line":42,"in_reply_to":"fa1b9901_8f5ebe74","updated":"2015-08-19 10:14:58.000000000","message":"Kairat,\n\nThis change contains doc change in doc/source/configuring.rst this is very manually maintained documentation of glance config options. As said the details are there included in this change, as this is not merged yet there is no possibility of these changes being in the repo. So please if you think that the documentation is not sufficient, add your comments there to clarify what you are looking for to get improved.\n\nSpecifying upper constraints would not make sense as the real limiting factor at the upper end is config option that might vary based on the deployment. Introducing upper limit here does not help the deployer as it would be purely artificial  and it would still allow the deployment having the max header size configured smaller than max req id length where header line size would still be the limiting factor just like it is now. Now we at least have those constraints documented and we do not claim any responsibility around sensible values there making sure we do not break the current behavior. This is also the reason why I\u0027m not willing to specify minimum length for the Req ID as that would very much break us from current behavior. Cinder had just (within last few days) really good example what happens when you do something like that ;)","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"eadeed76de641770bd70832865ba15140e1307e5","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                       \u0027read-only privileges. This only applies when using \u0027"},{"line_number":40,"context_line":"                       \u0027ContextMiddleware.\u0027)),"},{"line_number":41,"context_line":"    cfg.IntOpt(\u0027max_request_id_length\u0027, default\u003d0,"},{"line_number":42,"context_line":"               help\u003d_(\u0027Limits request ID length.\u0027)),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_8f5ebe74","line":42,"in_reply_to":"fa1b9901_947255ac","updated":"2015-08-19 09:30:03.000000000","message":"It seems some mis-understanding here. You are introducing new config here, so there should be no information in configuration guide about it. Just to be sure I checked github repository for liberty configuration guide for Glance. AFAIK the description of each parameter in this guide will be based (and automatically generated) on help parameter in cfg.Opt. It means that there will be no explanation what \"0\" means if you do not introduce it here.\nOf course, it is not big caveat but I think it would help users a bit and it is not so complex to provide more explanation about this config.\n\nRegarding min, max, it was just a recommendation to define allowed range, so let\u0027s keep it as it is.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"9721a087e1682a78bb90443f80e6e2ca744765c6","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                       \u0027read-only privileges. This only applies when using \u0027"},{"line_number":40,"context_line":"                       \u0027ContextMiddleware.\u0027)),"},{"line_number":41,"context_line":"    cfg.IntOpt(\u0027max_request_id_length\u0027, default\u003d0,"},{"line_number":42,"context_line":"               help\u003d_(\u0027Limits request ID length.\u0027)),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_16b434cf","line":42,"in_reply_to":"fa1b9901_eb0f59df","updated":"2015-08-18 14:49:21.000000000","message":"Regarding min value, we can put min here just to be sure that max_request_id_length is positive or 0 (check from \"the fools\"). Of course, it is optional but it is slightly increases the stability of the solution. \nI am more concerned about max value for this parameter. IMO, it is better to define the range where OS users can change this parameter.\nAlso, it would be good to explain users what default zero value means. \nAFAIU, it means that the length is not restricted but there is no info about this.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"ec5e2207b89f97e39706261a50ad6d2957e8786d","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                    _(\u0027Invalid service catalog json.\u0027))"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if request_id and (0 \u003c CONF.max_request_id_length \u003c"},{"line_number":117,"context_line":"                           len(request_id)):"},{"line_number":118,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":119,"context_line":"                   CONF.max_request_id_length)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_f9774100","line":116,"updated":"2015-08-18 10:11:30.000000000","message":"So when you will specify min and max for this option then you don\u0027t need this condition.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"7715b887eb736a4bbadaca6d92f192d33f6005d6","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                    _(\u0027Invalid service catalog json.\u0027))"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if request_id and (0 \u003c CONF.max_request_id_length \u003c"},{"line_number":117,"context_line":"                           len(request_id)):"},{"line_number":118,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":119,"context_line":"                   CONF.max_request_id_length)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_7983fc04","line":116,"in_reply_to":"fa1b9901_11399e41","updated":"2015-08-19 09:09:18.000000000","message":"There you have valid point. Thanks, good catch!","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"c367de26d6078dbcb9783eb64dcce3a3b23b3cc4","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                    _(\u0027Invalid service catalog json.\u0027))"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if request_id and (0 \u003c CONF.max_request_id_length \u003c"},{"line_number":117,"context_line":"                           len(request_id)):"},{"line_number":118,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":119,"context_line":"                   CONF.max_request_id_length)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_fcd2175b","line":116,"in_reply_to":"fa1b9901_7983fc04","updated":"2015-08-21 11:08:07.000000000","message":"I got fooled here. This is actually correct condition. We raise exception only if the length is bigger than max size not when it\u0027s at max size.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"9721a087e1682a78bb90443f80e6e2ca744765c6","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                    _(\u0027Invalid service catalog json.\u0027))"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if request_id and (0 \u003c CONF.max_request_id_length \u003c"},{"line_number":117,"context_line":"                           len(request_id)):"},{"line_number":118,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":119,"context_line":"                   CONF.max_request_id_length)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_11399e41","line":116,"in_reply_to":"fa1b9901_cb1cd515","updated":"2015-08-18 14:49:21.000000000","message":"Yep, that works, sorry, I missed that max_request_id_length\u003d0 means no validation here.\n\nI have another question: why do we have CONF.max_request_id_length \u003c len(request_id) instead of \u003c\u003d. IMO, max_request_id_length means \"max allowed request length\" but we will have an exception in this case. IMO, we have two ways here:\n1) refine the description of parameter\n2) replace \u003c with \u003c\u003d","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"d15303aae7643825daa23fe683afdd7936d82d47","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                    _(\u0027Invalid service catalog json.\u0027))"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if request_id and (0 \u003c CONF.max_request_id_length \u003c"},{"line_number":117,"context_line":"                           len(request_id)):"},{"line_number":118,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":119,"context_line":"                   CONF.max_request_id_length)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_cb1cd515","line":116,"in_reply_to":"fa1b9901_f9774100","updated":"2015-08-18 14:10:10.000000000","message":"Passing the ID is optional so it won\u0027t help on this.","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"ba0c3000da7803e7ca7c51f82e55e73e5137198d","unresolved":false,"context_lines":[{"line_number":113,"context_line":"                    _(\u0027Invalid service catalog json.\u0027))"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"        request_id \u003d req.headers.get(\u0027X-Openstack-Request-ID\u0027)"},{"line_number":116,"context_line":"        if request_id and (0 \u003c CONF.max_request_id_length \u003c"},{"line_number":117,"context_line":"                           len(request_id)):"},{"line_number":118,"context_line":"            msg \u003d (_(\u0027x-openstack-request-id is too long, max size %s\u0027) %"},{"line_number":119,"context_line":"                   CONF.max_request_id_length)"}],"source_content_type":"text/x-python","patch_set":5,"id":"da20952f_68054678","line":116,"in_reply_to":"fa1b9901_fcd2175b","updated":"2015-09-03 22:31:27.000000000","message":"So if we both fooled then probably code is not clear and it would be perfect to improve the clarity of the code but whatever:)","commit_id":"9fdc92b57bfb1e92fdb90e9bffc07bd928801630"}]}