)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"ebcdbb0e1a1e37ac44dc7aca98b3c7ca01f6a92e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"result in a non-backward compatible API behavior change and no"},{"line_number":21,"context_line":"microversion is being introduced for this because enforcement via"},{"line_number":22,"context_line":"a new microversion would not close the security gap on any previous"},{"line_number":23,"context_line":"microversions."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Related compute API reference and user documentation is updated"},{"line_number":26,"context_line":"to mention the policy rule along with a release note since"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_c216a559","line":23,"updated":"2018-06-15 15:46:09.000000000","message":"++ this is a bugfix so it can change API behavior without microversion bump.","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"585e4b7b5d88f23884cc056a4c148decbdd89be3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"result in a non-backward compatible API behavior change and no"},{"line_number":21,"context_line":"microversion is being introduced for this because enforcement via"},{"line_number":22,"context_line":"a new microversion would not close the security gap on any previous"},{"line_number":23,"context_line":"microversions."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Related compute API reference and user documentation is updated"},{"line_number":26,"context_line":"to mention the policy rule along with a release note since"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_0574a735","line":23,"in_reply_to":"5f7c97a3_c216a559","updated":"2018-06-15 15:50:16.000000000","message":"Well, that\u0027s not always the case, but in this situation, a microversion is not appropriate because then the malicious user has to opt into not being malicious, which defeats the purpose of the fix.","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"}],"nova/compute/api.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a668f950fe09e75756355fd6eefcf583b28498b9","unresolved":false,"context_lines":[{"line_number":624,"context_line":"                    raise exception.FlavorDiskSmallerThanMinDisk("},{"line_number":625,"context_line":"                        flavor_size\u003ddest_size, image_min_disk\u003dimage_min_disk)"},{"line_number":626,"context_line":"            else:"},{"line_number":627,"context_line":"                # The user is attempting to create a server with a 0-disk"},{"line_number":628,"context_line":"                # image-backed flavor, which can lead to issues with a large"},{"line_number":629,"context_line":"                # image consuming an unexpectedly large amount of local disk"},{"line_number":630,"context_line":"                # on the compute host. Check to see if the deployment will"},{"line_number":631,"context_line":"                # allow that."}],"source_content_type":"text/x-python","patch_set":1,"id":"bf659307_2ed8e61b","line":628,"range":{"start_line":627,"start_character":18,"end_line":628,"end_character":37},"updated":"2018-04-13 18:06:57.000000000","message":"nit: re-word as \"The user is attempting to create an image-backed server with a 0-disk flavor,\"","commit_id":"c4d9f5a0f21534c4c4676d2b29c57b127e041785"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1d115c42b2302052b11c33c1fc722d5f83ba4045","unresolved":false,"context_lines":[{"line_number":629,"context_line":"                # image consuming an unexpectedly large amount of local disk"},{"line_number":630,"context_line":"                # on the compute host. Check to see if the deployment will"},{"line_number":631,"context_line":"                # allow that."},{"line_number":632,"context_line":"                if CONF.api.enforce_volume_backed_for_zero_disk_flavor:"},{"line_number":633,"context_line":"                    raise exception.BootFromVolumeRequiredForZeroDiskFlavor()"},{"line_number":634,"context_line":"                # Log a warning to indicate that this cloud is opting into"},{"line_number":635,"context_line":"                # a known potential security issue."}],"source_content_type":"text/x-python","patch_set":1,"id":"bf659307_4e70ba40","line":632,"updated":"2018-04-13 18:02:31.000000000","message":"As soon as I pushed this up for review, I thought this would probably be better as a new policy rule, since we can define rules in code. It would default to @ (all) for backward compat but then we could change it to rule:admin_api or whatever in Stein.","commit_id":"c4d9f5a0f21534c4c4676d2b29c57b127e041785"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c10443ef7aa0cb97919265ca69b46ebfa909c9d8","unresolved":false,"context_lines":[{"line_number":634,"context_line":"                # Log a warning to indicate that this cloud is opting into"},{"line_number":635,"context_line":"                # a known potential security issue."},{"line_number":636,"context_line":"                LOG.warning(\u0027This deployment allows creating \u0027"},{"line_number":637,"context_line":"                            \u0027non-volume-backed servers with flavor %s that \u0027"},{"line_number":638,"context_line":"                            \u0027does not specify root disk size. This is \u0027"},{"line_number":639,"context_line":"                            \u0027potentially hazardous if you allow users to \u0027"},{"line_number":640,"context_line":"                            \u0027upload their own images as the size of the \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"bf659307_ee2c2e03","line":637,"range":{"start_line":637,"start_character":29,"end_line":637,"end_character":46},"updated":"2018-04-13 18:09:47.000000000","message":"\"image-backed\" is probably better and what I\u0027m trying to use in the docs and release note.","commit_id":"c4d9f5a0f21534c4c4676d2b29c57b127e041785"}],"nova/policies/servers.py":[{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"427f7d30615c2389695a260801071c997a00a046","unresolved":false,"context_lines":[{"line_number":151,"context_line":"cannot select the compute host based on the virtual image size. Therefore, 0"},{"line_number":152,"context_line":"should only be used for volume booted instances or for testing purposes."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"WARNING: It is a potential security exposure to enable this policy rule"},{"line_number":155,"context_line":"if users can upload their own images since repeated attempts to"},{"line_number":156,"context_line":"create a disk\u003d0 flavor instance with a large image can exhaust"},{"line_number":157,"context_line":"the local disk of the compute (or shared storage cluster). See bug"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_255d2315","line":154,"range":{"start_line":154,"start_character":0,"end_line":154,"end_character":9},"updated":"2018-06-15 15:40:09.000000000","message":"nit:\n\n  .. warning::","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"585e4b7b5d88f23884cc056a4c148decbdd89be3","unresolved":false,"context_lines":[{"line_number":151,"context_line":"cannot select the compute host based on the virtual image size. Therefore, 0"},{"line_number":152,"context_line":"should only be used for volume booted instances or for testing purposes."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"WARNING: It is a potential security exposure to enable this policy rule"},{"line_number":155,"context_line":"if users can upload their own images since repeated attempts to"},{"line_number":156,"context_line":"create a disk\u003d0 flavor instance with a large image can exhaust"},{"line_number":157,"context_line":"the local disk of the compute (or shared storage cluster). See bug"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_e5908b45","line":154,"range":{"start_line":154,"start_character":0,"end_line":154,"end_character":9},"in_reply_to":"5f7c97a3_255d2315","updated":"2018-06-15 15:50:16.000000000","message":"Done","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fc55429803461087441f636fb36d59588ada9b17","unresolved":false,"context_lines":[{"line_number":151,"context_line":"cannot select the compute host based on the virtual image size. Therefore, 0"},{"line_number":152,"context_line":"should only be used for volume booted instances or for testing purposes."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"WARNING: It is a potential security exposure to enable this policy rule"},{"line_number":155,"context_line":"if users can upload their own images since repeated attempts to"},{"line_number":156,"context_line":"create a disk\u003d0 flavor instance with a large image can exhaust"},{"line_number":157,"context_line":"the local disk of the compute (or shared storage cluster). See bug"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_e5964bf0","line":154,"range":{"start_line":154,"start_character":0,"end_line":154,"end_character":9},"in_reply_to":"5f7c97a3_e5908b45","updated":"2018-06-15 15:57:35.000000000","message":"Actually that doesn\u0027t build, hitting unexpected indent errors when building the docs.","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"}],"nova/tests/functional/wsgi/test_servers.py":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"ebcdbb0e1a1e37ac44dc7aca98b3c7ca01f6a92e","unresolved":false,"context_lines":[{"line_number":352,"context_line":""},{"line_number":353,"context_line":"    def test_create_image_backed_server_with_zero_disk_fails(self):"},{"line_number":354,"context_line":"        \"\"\"Tests that a non-admin trying to create an image-backed server"},{"line_number":355,"context_line":"        using a flavor with 0 disk will result in a 400 error when rule"},{"line_number":356,"context_line":"        os_compute_api:servers:create:zero_disk_flavor is set to admin-only."},{"line_number":357,"context_line":"        \"\"\""},{"line_number":358,"context_line":"        self.policy_fixture.set_rules({"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_850bd7d3","line":355,"range":{"start_line":355,"start_character":52,"end_line":355,"end_character":55},"updated":"2018-06-15 15:46:09.000000000","message":"nit: 403","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"585e4b7b5d88f23884cc056a4c148decbdd89be3","unresolved":false,"context_lines":[{"line_number":352,"context_line":""},{"line_number":353,"context_line":"    def test_create_image_backed_server_with_zero_disk_fails(self):"},{"line_number":354,"context_line":"        \"\"\"Tests that a non-admin trying to create an image-backed server"},{"line_number":355,"context_line":"        using a flavor with 0 disk will result in a 400 error when rule"},{"line_number":356,"context_line":"        os_compute_api:servers:create:zero_disk_flavor is set to admin-only."},{"line_number":357,"context_line":"        \"\"\""},{"line_number":358,"context_line":"        self.policy_fixture.set_rules({"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_2571a345","line":355,"range":{"start_line":355,"start_character":52,"end_line":355,"end_character":55},"in_reply_to":"5f7c97a3_850bd7d3","updated":"2018-06-15 15:50:16.000000000","message":"Done","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"8ad4458623904f91a77fff9817ca6cc5d2d976a1","unresolved":false,"context_lines":[{"line_number":363,"context_line":"            \u0027test_create_image_backed_server_with_zero_disk_fails\u0027,"},{"line_number":364,"context_line":"            fake_image.AUTO_DISK_CONFIG_ENABLED_IMAGE_UUID,"},{"line_number":365,"context_line":"            self.zero_disk_flavor[\u0027id\u0027])"},{"line_number":366,"context_line":"        ex \u003d self.assertRaises(api_client.OpenStackApiException,"},{"line_number":367,"context_line":"                               self.api.post_server, {\u0027server\u0027: server_req})"},{"line_number":368,"context_line":"        self.assertIn(\u0027Only volume-backed servers are allowed for flavors \u0027"},{"line_number":369,"context_line":"                      \u0027with zero disk.\u0027, six.text_type(ex))"},{"line_number":370,"context_line":"        self.assertEqual(403, ex.response.status_code)"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"    def test_create_volume_backed_server_with_zero_disk_allowed(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_a56e13fe","line":369,"range":{"start_line":366,"start_character":0,"end_line":369,"end_character":59},"updated":"2018-06-15 16:01:36.000000000","message":"random aside, I discovered assertRaisesRegex today which allows you to do this in one call. Pretty nifty, if you ask me","commit_id":"a11f0adf3104ec05860386660faf9e0246d43793"}],"nova/tests/unit/test_policy.py":[{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"427f7d30615c2389695a260801071c997a00a046","unresolved":false,"context_lines":[{"line_number":379,"context_line":"\"os_compute_api:servers:create:attach_network\","},{"line_number":380,"context_line":"\"os_compute_api:servers:create:attach_volume\","},{"line_number":381,"context_line":"\"os_compute_api:servers:create:trusted_certs\","},{"line_number":382,"context_line":"servers_policies.ZERO_DISK_FLAVOR,"},{"line_number":383,"context_line":"\"os_compute_api:servers:create_image\","},{"line_number":384,"context_line":"\"os_compute_api:servers:delete\","},{"line_number":385,"context_line":"\"os_compute_api:servers:detail\","}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_65631bdf","line":382,"range":{"start_line":382,"start_character":0,"end_line":382,"end_character":34},"updated":"2018-06-15 15:40:09.000000000","message":"nit: Personally, I\u0027d rather we hardcoded this to doubly verify things (no typos, etc.)","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"585e4b7b5d88f23884cc056a4c148decbdd89be3","unresolved":false,"context_lines":[{"line_number":379,"context_line":"\"os_compute_api:servers:create:attach_network\","},{"line_number":380,"context_line":"\"os_compute_api:servers:create:attach_volume\","},{"line_number":381,"context_line":"\"os_compute_api:servers:create:trusted_certs\","},{"line_number":382,"context_line":"servers_policies.ZERO_DISK_FLAVOR,"},{"line_number":383,"context_line":"\"os_compute_api:servers:create_image\","},{"line_number":384,"context_line":"\"os_compute_api:servers:delete\","},{"line_number":385,"context_line":"\"os_compute_api:servers:detail\","}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_659c7b5b","line":382,"range":{"start_line":382,"start_character":0,"end_line":382,"end_character":34},"in_reply_to":"5f7c97a3_65631bdf","updated":"2018-06-15 15:50:16.000000000","message":"Done","commit_id":"068ede306205b655a3d3b1f4fad2ed9d4673de58"}]}