)]}'
{"id":"openstack%2Fnova~803182","triplet_id":"openstack%2Fnova~stable%2Frocky~Ie36401c782f023d1d5f2623732619105dc2cfa24","project":"openstack/nova","branch":"stable/rocky","topic":"bug/1927677-stable/rocky","hashtags":[],"change_id":"Ie36401c782f023d1d5f2623732619105dc2cfa24","subject":"Reject open redirection in the console proxy","status":"ABANDONED","created":"2021-08-02 13:39:06.000000000","updated":"2022-11-11 18:31:40.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"cherry_pick_of_change":802935,"cherry_pick_of_patch_set":4,"meta_rev_id":"bf29b47c221b151a9595d9fc75c4d999e8001488","_number":803182,"virtual_id_number":803182,"owner":{"_account_id":20312,"name":"Jacek Tomasiak","email":"jacek.tomasiak@gmail.com","username":"skazi"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2021-08-02 15:44:09.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"permitted_voting_range":{"min":0,"max":2},"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},{"value":0,"permitted_voting_range":{"min":0,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{" 0":"Default Priority","+1":"Contributor Review Promise","+2":"Core Review Promise"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":10118,"name":"IBM PowerKVM CI","email":"kvmpower@linux.vnet.ibm.com","username":"powerkvm","tags":["SERVICE_USER"]}],"REVIEWER":[{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2021-08-02 13:39:06.000000000","updated_by":{"_account_id":20312,"name":"Jacek Tomasiak","email":"jacek.tomasiak@gmail.com","username":"skazi"},"reviewer":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"state":"REVIEWER"},{"updated":"2021-08-02 15:17:35.000000000","updated_by":{"_account_id":10118,"name":"IBM PowerKVM CI","email":"kvmpower@linux.vnet.ibm.com","username":"powerkvm","tags":["SERVICE_USER"]},"reviewer":{"_account_id":10118,"name":"IBM PowerKVM CI","email":"kvmpower@linux.vnet.ibm.com","username":"powerkvm","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2021-08-02 15:44:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"bc8695a1d59e8ca8b1edb8735ed78f52d498a050","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":20312,"name":"Jacek Tomasiak","email":"jacek.tomasiak@gmail.com","username":"skazi"},"date":"2021-08-02 13:39:06.000000000","message":"Patch Set 1: Cherry Picked from branch stable/stein.","accounts_in_message":[],"_revision_number":1},{"id":"5e688cabf73b27b69c8da88195b4ccc77a372c05","author":{"_account_id":10118,"name":"IBM PowerKVM CI","email":"kvmpower@linux.vnet.ibm.com","username":"powerkvm","tags":["SERVICE_USER"]},"date":"2021-08-02 15:17:35.000000000","message":"Patch Set 1:\n\nBuild succeeded. Test completed on IBM PowerKVM platform. For rechecking only on the IBM PowerKVM CI, add a review comment with pkvm- recheck. For contact and more information, see https://wiki.openstack.org/wiki/PowerKVM\n\n- tempest-dsvm-full-bionic-py3 https://oplab9.parqtec.unicamp.br/pub/ppc64el/openstack/nova/82/803182/1/check/tempest-dsvm-full-bionic-py3/63d0cb8/ : SUCCESS in 1h 34m 48s","accounts_in_message":[],"_revision_number":1},{"id":"c67a8efe83f4faab263a34d50658f1f4acf9fb48","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-08-02 15:44:09.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c686bfb1137c41b5a7a274290e564e2b : FAILURE in 12m 18s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/f3525961853640b9a8ce79802e5f0bbc : SUCCESS in 11m 53s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/b8fa2d99f73842c5896f0b4002966b63 : SUCCESS in 17m 08s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/b37cb87655d14080af3e859e7df16edb : SUCCESS in 10m 22s\n- tempest-full https://zuul.opendev.org/t/openstack/build/286601d357f34711a71669ddaed24f97 : FAILURE in 1h 00m 34s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/b106d3e9781a4275adfbf1a7b1123a07 : FAILURE in 8m 17s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/90c573c84170457c825d6aff02400b5d : SUCCESS in 1h 20m 37s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/24b7a18675f14be69225fee25df69e7d : FAILURE in 18m 48s\n- ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa https://zuul.opendev.org/t/openstack/build/7207a6b148674b27a7eebcc9e246aba5 : SUCCESS in 51m 42s (non-voting)\n- nova-cells-v1 https://zuul.opendev.org/t/openstack/build/3bf322dfdc244bcfa7265b9b99dc1339 : FAILURE in 7m 56s\n- nova-grenade-live-migration https://zuul.opendev.org/t/openstack/build/7f60a1a23c914d7ba81e408a42b02d15 : FAILURE in 13m 43s (non-voting)\n- nova-live-migration https://zuul.opendev.org/t/openstack/build/cb143d79e5fa472886fceef2bbc993c2 : FAILURE in 10m 17s\n- nova-multiattach https://zuul.opendev.org/t/openstack/build/e2e7ae8451254f6bb023f0b4dbd0fdcb : FAILURE in 17m 31s\n- nova-next https://zuul.opendev.org/t/openstack/build/394fc7e272644ca3a520768f4bb427ac : FAILURE in 15m 03s\n- tempest-slow https://zuul.opendev.org/t/openstack/build/f406874dff664958bb2f8a966d19ced0 : SUCCESS in 1h 59m 42s\n- nova-tox-functional https://zuul.opendev.org/t/openstack/build/de8996cd6fd0494a9b5bf56f28f30bd7 : SUCCESS in 18m 19s\n- nova-tox-functional-py35 https://zuul.opendev.org/t/openstack/build/f47d7f91b1824081800da3f3be86d41c : SUCCESS in 15m 41s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/36d9f37e229d47f7b700a63bc26f887c : FAILURE in 5m 24s (non-voting)\n- neutron-grenade-multinode https://zuul.opendev.org/t/openstack/build/2e7aaf018f55495586f075e1378341d7 : FAILURE in 10m 08s\n- tempest-multinode-full https://zuul.opendev.org/t/openstack/build/f45340999144487387a60e4333371678 : SUCCESS in 1h 32m 52s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"bf29b47c221b151a9595d9fc75c4d999e8001488","tag":"autogenerated:gerrit:abandon","author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2022-11-11 18:31:40.000000000","message":"Abandoned\n\nThis branch transitioned to End of Life for this project, open patches needs to be closed to be able to delete the branch.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"93f271338d301af53f873c207e67b2c4239b3bc6","revisions":{"93f271338d301af53f873c207e67b2c4239b3bc6":{"kind":"REWORK","_number":1,"created":"2021-08-02 13:39:06.000000000","uploader":{"_account_id":20312,"name":"Jacek Tomasiak","email":"jacek.tomasiak@gmail.com","username":"skazi"},"ref":"refs/changes/82/803182/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/nova","ref":"refs/changes/82/803182/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/nova refs/changes/82/803182/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/nova refs/changes/82/803182/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/nova refs/changes/82/803182/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/nova refs/changes/82/803182/1"}}},"commit":{"parents":[{"commit":"0049f0370fcc8f1ff915b27ed20c3f3270b56e26","subject":"Merge \"Remove allocations before setting vm_status to SHELVED_OFFLOADED\" into stable/rocky","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/0049f0370fcc8f1ff915b27ed20c3f3270b56e26"}]}],"author":{"name":"melanie witt","email":"melwittt@gmail.com","date":"2021-05-13 05:43:42.000000000","tz":0},"committer":{"name":"Jacek Tomasiak","email":"jacek.tomasiak@gmail.com","date":"2021-08-02 13:39:06.000000000","tz":0},"subject":"Reject open redirection in the console proxy","message":"Reject open redirection in the console proxy\n\nNOTE(melwitt): This is the combination of two commits, the bug fix and\na followup change to the unit test to enable it also run on\nPython \u003c 3.6.\n\nOur console proxies (novnc, serial, spice) run in a websockify server\nwhose request handler inherits from the python standard\nSimpleHTTPRequestHandler. There is a known issue [1] in the\nSimpleHTTPRequestHandler which allows open redirects by way of URLs\nin the following format:\n\n  http://vncproxy.my.domain.com//example.com/%2F..\n\nwhich if visited, will redirect a user to example.com.\n\nWe can intercept a request and reject requests that pass a redirection\nURL beginning with \"//\" by implementing the\nSimpleHTTPRequestHandler.send_head() method containing the\nvulnerability to reject such requests with a 400 Bad Request.\n\nThis code is copied from a patch suggested in one of the issue comments\n[2].\n\nCloses-Bug: #1927677\n\n[1] https://bugs.python.org/issue32084\n[2] https://bugs.python.org/issue32084#msg306545\n\nReduce mocking in test_reject_open_redirect for compat\n\nThis is a followup for change Ie36401c782f023d1d5f2623732619105dc2cfa24\nto reduce mocking in the unit test coverage for it.\n\nWhile backporting the bug fix, it was found to be incompatible with\nearlier versions of Python \u003c 3.6 due to a difference in internal\nimplementation [1].\n\nThis reduces the mocking in the unit test to be more agnostic to the\ninternals of the StreamRequestHandler (ancestor of\nSimpleHTTPRequestHandler) and work across Python versions \u003e\u003d 2.7.\n\nRelated-Bug: #1927677\n\n[1] https://github.com/python/cpython/commit/34eeed42901666fce099947f93dfdfc05411f286\n\nChange-Id: I546d376869a992601b443fb95acf1034da2a8f36\n(cherry picked from commit 214cabe6848a1fdb4f5941d994c6cc11107fc4af)\n(cherry picked from commit 9c2f29783734cb5f9cb05a08d328c10e1d16c4f1)\n(cherry picked from commit 94e265f3ca615aa18de0081a76975019997b8709)\n(cherry picked from commit d43b88a33407b1253e7bce70f720a44f7688141f)\n\nChange-Id: Ie36401c782f023d1d5f2623732619105dc2cfa24\n(cherry picked from commit 781612b33282ed298f742c85dab58a075c8b793e)\n(cherry picked from commit 470925614223c8dd9b1233f54f5a96c02b2d4f70)\n(cherry picked from commit 6b70350bdcf59a9712f88b6435ba2c6500133e5b)\n(cherry picked from commit 719e651e6be277950632e0c2cf5cc9a018344e7b)\n(cherry picked from commit 5cb4d618ca67e622bbae24c768f9bdf408570986)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/93f271338d301af53f873c207e67b2c4239b3bc6"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/93f271338d301af53f873c207e67b2c4239b3bc6"}]},"branch":"refs/heads/stable/rocky"}},"requirements":[],"submit_records":[],"submit_requirements":[]}