)]}'
{"swift/common/middleware/tempurl.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"051de71117bf753b199cd8c3ee08e8b26f3536ab","unresolved":false,"context_lines":[{"line_number":312,"context_line":"import six"},{"line_number":313,"context_line":"from os.path import basename"},{"line_number":314,"context_line":"from time import time, strftime, strptime, gmtime"},{"line_number":315,"context_line":"from ipaddress import ip_address, ip_network"},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"from six.moves.urllib.parse import parse_qs"},{"line_number":318,"context_line":"from six.moves.urllib.parse import urlencode"}],"source_content_type":"text/x-python","patch_set":11,"id":"5f7c97a3_b2014eb8","line":315,"range":{"start_line":315,"start_character":5,"end_line":315,"end_character":14},"updated":"2018-06-29 22:35:06.000000000","message":"We should add this to requirements.txt. Currently, it gets pulled in as a transitive dep via cryptography, but it\u0027d be better to make that requirement explicit.","commit_id":"ec2237a05d7ac1f62eee4ec7689a44d8a0967944"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e61814f7122483592c2c02064a0dbb6930cdb78f","unresolved":false,"context_lines":[{"line_number":528,"context_line":""},{"line_number":529,"context_line":"        if temp_url_ip_range:"},{"line_number":530,"context_line":"            req \u003d Request(env)"},{"line_number":531,"context_line":"            client_address \u003d get_remote_client(req)"},{"line_number":532,"context_line":"            if client_address is None:"},{"line_number":533,"context_line":"                return self._invalid(env, start_response)"},{"line_number":534,"context_line":"            allowed_ip_ranges \u003d ip_network(six.u(temp_url_ip_range))"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_2414004d","line":531,"range":{"start_line":531,"start_character":29,"end_line":531,"end_character":46},"updated":"2018-07-02 17:31:01.000000000","message":"I wasn\u0027t familiar with this util function before; looks like we\u0027re currently just using it for logging? And I guess swauth uses it for allowed_sync_hosts -- https://github.com/openstack/swift/commit/adb45bc\n\nI\u0027m a little nervous about using it for a security-related function, though, since it looks at client headers...\n\nWhat\u0027s to stop someone who already knows the tempurl (which includes a temp_url_ip_range\u003d1.2.3.0/24 query param, say) from just including a\n\n X-Forwarded-For: 1.2.3.4\n\nheader when they go to download? I\u0027d feel better about *just* looking at env[\u0027REMOTE_ADDR\u0027] but maybe that\u0027d break with some proxy setups? What are your thoughts here?","commit_id":"e904a8a151362296523b43dcfd7e113acb0c880f"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"e61814f7122483592c2c02064a0dbb6930cdb78f","unresolved":false,"context_lines":[{"line_number":531,"context_line":"            client_address \u003d get_remote_client(req)"},{"line_number":532,"context_line":"            if client_address is None:"},{"line_number":533,"context_line":"                return self._invalid(env, start_response)"},{"line_number":534,"context_line":"            allowed_ip_ranges \u003d ip_network(six.u(temp_url_ip_range))"},{"line_number":535,"context_line":"            if ip_address(six.u(client_address)) not in allowed_ip_ranges:"},{"line_number":536,"context_line":"                return self._invalid(env, start_response)"},{"line_number":537,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_67bc3adb","line":534,"range":{"start_line":534,"start_character":32,"end_line":534,"end_character":42},"updated":"2018-07-02 17:31:01.000000000","message":"This could raise a ValueError if temp_url_ip_range is invalid:\n\n ValueError: u\u0027adsf\u0027 does not appear to be an IPv4 or IPv6 network\n\nWe should catch that and return self._invalid(...) -- probably have it also cover the ip_address call below.","commit_id":"e904a8a151362296523b43dcfd7e113acb0c880f"}],"test/unit/common/test_wsgi.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"f7745aa394c34b2b694ffcafb641b5ca7e965024","unresolved":false,"context_lines":[{"line_number":1262,"context_line":"            \u0027SERVER_ADDR\u0027: \u0027222.222.222.222\u0027,"},{"line_number":1263,"context_line":"            \u0027OTHER_ENV_KEY\u0027: \u0027OTHER_ENV_VALUE\u0027"},{"line_number":1264,"context_line":"        }"},{"line_number":1265,"context_line":"        self.assertEqual(proxy_obj.get_environ(), expected_env)"},{"line_number":1266,"context_line":""},{"line_number":1267,"context_line":""},{"line_number":1268,"context_line":"class TestServersPerPortStrategy(unittest.TestCase):"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_94cee629","line":1265,"updated":"2018-07-09 21:09:22.000000000","message":"What are we looking to get out of this test that isn\u0027t covered by something like test_request_with_proxy? I guess there\u0027s the fact that OTHER_ENV_KEY is preserved...\n\nFWIW, the other tests intentionally *don\u0027t* mock out any of the eventlet classes in part to ensure that whatever version we test against still populates REMOTE_ADDR correctly from self.client_address","commit_id":"26b20ee7296442231e74c982891a9b85c217ff79"}]}