)]}'
{"swift/common/constraints.py":[{"author":{"_account_id":330,"name":"John Dickinson","email":"me@not.mn","username":"notmyname"},"change_message_id":"daffec1932a9b937a7d50f1325b4a93aaa0fbb01","unresolved":false,"context_lines":[{"line_number":181,"context_line":"            return HTTPBadRequest("},{"line_number":182,"context_line":"                body\u003d\u0027Total metadata too large; max %d\u0027"},{"line_number":183,"context_line":"                % MAX_META_OVERALL_SIZE,"},{"line_number":184,"context_line":"                request\u003dreq, content_type\u003d\u0027text/plain\u0027)"},{"line_number":185,"context_line":"    checked.append(target_type)"},{"line_number":186,"context_line":"    req.headers[\u0027X-Backend-Metadata-Checked\u0027] \u003d \u0027,\u0027.join(checked)"},{"line_number":187,"context_line":"    return None"}],"source_content_type":"text/x-python","patch_set":7,"id":"3aaa91ec_a9d2f859","line":184,"updated":"2016-06-23 23:27:52.000000000","message":"Do these need to be elif, or can they be switched to plain ifs? I know this is unchanged from master, but might be a small cleanup that can be done.","commit_id":"619dd675bdc06ee607a02b94bab24b3d0d664e37"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"371b2f3a4319726607d6536ce8aadc0d1224b2e6","unresolved":false,"context_lines":[{"line_number":181,"context_line":"            return HTTPBadRequest("},{"line_number":182,"context_line":"                body\u003d\u0027Total metadata too large; max %d\u0027"},{"line_number":183,"context_line":"                % MAX_META_OVERALL_SIZE,"},{"line_number":184,"context_line":"                request\u003dreq, content_type\u003d\u0027text/plain\u0027)"},{"line_number":185,"context_line":"    checked.append(target_type)"},{"line_number":186,"context_line":"    req.headers[\u0027X-Backend-Metadata-Checked\u0027] \u003d \u0027,\u0027.join(checked)"},{"line_number":187,"context_line":"    return None"}],"source_content_type":"text/x-python","patch_set":7,"id":"3aaa91ec_66db0450","line":184,"in_reply_to":"3aaa91ec_a9d2f859","updated":"2016-06-24 11:24:49.000000000","message":"Done","commit_id":"619dd675bdc06ee607a02b94bab24b3d0d664e37"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"a72bb2b6fc12903ff0f5c5395595f0b0fd21664a","unresolved":false,"context_lines":[{"line_number":117,"context_line":"MAX_HEADER_COUNT \u003d MAX_META_COUNT + 32 + max(EXTRA_HEADER_COUNT, 0)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"def check_metadata(req, target_type):"},{"line_number":121,"context_line":"    \"\"\""},{"line_number":122,"context_line":"    Check metadata sent in the request headers.  This should only check"},{"line_number":123,"context_line":"    that the metadata in the request given is valid.  Checks against"}],"source_content_type":"text/x-python","patch_set":10,"id":"3aaa91ec_763fc4d6","line":120,"updated":"2016-06-27 23:01:54.000000000","message":"If we stick with this approach, should we move this call out of proxy/controllers/* and into common/middleware/gatekeeper.py?\n\nAt that point, would any other middleware ever need to call it?","commit_id":"24c2b08933881473d75a13be276c151f70ecf7b5"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"a15f735821480ba1c8b1d5f160b7487bf28cbbc7","unresolved":false,"context_lines":[{"line_number":117,"context_line":"MAX_HEADER_COUNT \u003d MAX_META_COUNT + 32 + max(EXTRA_HEADER_COUNT, 0)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"def check_metadata(req, target_type):"},{"line_number":121,"context_line":"    \"\"\""},{"line_number":122,"context_line":"    Check metadata sent in the request headers.  This should only check"},{"line_number":123,"context_line":"    that the metadata in the request given is valid.  Checks against"}],"source_content_type":"text/x-python","patch_set":10,"id":"3aaa91ec_c27b3d7a","line":120,"in_reply_to":"3aaa91ec_066c479b","updated":"2016-06-28 10:44:30.000000000","message":"@Kota, ok good point - if we move to one check in gatekeeper then we don\u0027t catch *mistakes* nor malicious abuse of meta headers","commit_id":"24c2b08933881473d75a13be276c151f70ecf7b5"},{"author":{"_account_id":4608,"name":"Kota Tsuyuzaki","email":"bloodeagle40234@gmail.com","username":"tsuyuzaki-kota"},"change_message_id":"61d7791e20d14e0f972bfde44dd27e382d4c56bb","unresolved":false,"context_lines":[{"line_number":117,"context_line":"MAX_HEADER_COUNT \u003d MAX_META_COUNT + 32 + max(EXTRA_HEADER_COUNT, 0)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"def check_metadata(req, target_type):"},{"line_number":121,"context_line":"    \"\"\""},{"line_number":122,"context_line":"    Check metadata sent in the request headers.  This should only check"},{"line_number":123,"context_line":"    that the metadata in the request given is valid.  Checks against"}],"source_content_type":"text/x-python","patch_set":10,"id":"3aaa91ec_066c479b","line":120,"in_reply_to":"3aaa91ec_763fc4d6","updated":"2016-06-28 08:23:01.000000000","message":"I don\u0027t think this staff should be easy to skip whenever the header set.\n\nThat is because any middleware can modify x-object-meta namespace (I know it\u0027s not safe and it should use x-object-sysmeta instead IMHO, though) and third party middleware may add a invalid metadata into a request. Currently it\u0027s working because check_metadata always happen in proxy-server app on the most right placed in the pipeline as a last-resort so we don\u0027t accept any invalid metadata at the end of the pipeline.\n\n\nHowever, this change can be a hole of an injection for skipping the check in earlier place of pipeline. Probably, the last resort can be skipped even if \"The setter of X-Backend-Metadata-Checked didn\u0027t check anything actually\". For example, the gatekeeper (most left placed middleware does check_metadata and append skip flag into the header, and then, third party (e.g. swift3/storlets) add a x-object-meta-** header. That header won\u0027t be checked, anymore even if it was unfortunately on invalid syntax (just a bug not intentionally) in Swift world and it can be acceptable. This is the worst problem.\n\n\nRather than current one, I\u0027d like to bet for adding md5 value of the user meta data like [1] instead of adding skip flag. With my benchmark, yes it makes more overhead rather than current simple skip flag but it shows better performance than doing whole check_metadata for each call so I think it\u0027s *reasonable*. And if we go md5 way, at least we can prevent to loose metadata check, unless a third party middleware set the md5 value w/o calling check_metadata intentionally.\n\nhttps://gist.github.com/bloodeagle40234/a8a0166e612e28fa41a59ab8152371e9","commit_id":"24c2b08933881473d75a13be276c151f70ecf7b5"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"a15f735821480ba1c8b1d5f160b7487bf28cbbc7","unresolved":false,"context_lines":[{"line_number":117,"context_line":"MAX_HEADER_COUNT \u003d MAX_META_COUNT + 32 + max(EXTRA_HEADER_COUNT, 0)"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"def check_metadata(req, target_type):"},{"line_number":121,"context_line":"    \"\"\""},{"line_number":122,"context_line":"    Check metadata sent in the request headers.  This should only check"},{"line_number":123,"context_line":"    that the metadata in the request given is valid.  Checks against"}],"source_content_type":"text/x-python","patch_set":10,"id":"3aaa91ec_9f9d0e5c","line":120,"in_reply_to":"3aaa91ec_763fc4d6","updated":"2016-06-28 10:44:30.000000000","message":"This (move to gatekeeper) was the intention but left for a follow-up (baby steps...)","commit_id":"24c2b08933881473d75a13be276c151f70ecf7b5"}]}