)]}'
{"id":"openstack%2Fswift~871501","triplet_id":"openstack%2Fswift~stable%2Fstein~I84494123cfc85e234098c554ecd3e77981f8a096","project":"openstack/swift","branch":"stable/stein","topic":"bug/1998625-stable/train-stable/stein","attention_set":{},"removed_from_attention_set":{"15343":{"account":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"last_update":"2023-01-25 22:51:32.000000000","reason":"\u003cGERRIT_ACCOUNT_15343\u003e replied on the change","reason_account":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}}},"hashtags":[],"change_id":"I84494123cfc85e234098c554ecd3e77981f8a096","subject":"s3api: Prevent XXE injections","status":"MERGED","created":"2023-01-23 20:46:10.000000000","updated":"2023-01-25 23:45:35.000000000","submitted":"2023-01-25 23:44:19.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"871501-bug/1998625-stable/train-stable/stein","cherry_pick_of_change":871244,"cherry_pick_of_patch_set":3,"meta_rev_id":"fabc0b4135173d1295cc173cf0d42e61a3837437","_number":871501,"virtual_id_number":871501,"owner":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2023-01-25 23:44:19.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2023-01-25 22:51:32.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2023-01-25 22:51:32.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":32333,"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@gmail.com","username":"AymericDu"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2023-01-23 20:46:10.000000000","updated_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"reviewer":{"_account_id":32333,"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@gmail.com","username":"AymericDu"},"state":"CC"},{"updated":"2023-01-23 22:12:19.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"3027270f12cfbb13f9e99eb98598621d9e4eaab8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-23 20:46:10.000000000","message":"Patch Set 1: Cherry Picked from branch stable/train.","accounts_in_message":[],"_revision_number":1},{"id":"69722bb3fafa32ec4ad561710d17bd484598a8ad","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-23 21:19:10.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"702fb1ce97105e5fd6e8d7805dbfa8b7ba446614","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-23 21:35:31.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"1fe6c1fd458e18d40733cd14114118e0d4ef9461","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-23 22:12:19.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/a9935ce65864406b865e5e65fa9bcb1f\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2be5cda09cfc464ea5ed3bb362b2c68d : SUCCESS in 5m 27s\n- requirements-check https://zuul.opendev.org/t/openstack/build/28e0226849cf4552b3497dc3848a50f4 : FAILURE in 2m 58s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/021b607f8d4e47b19f573d9b94a81e18 : SUCCESS in 4m 20s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/6b7633a335c1437d8f12889ee5907f84 : SUCCESS in 8m 37s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/7d86d6dccf504e5d9e4b27e2002406b0 : SUCCESS in 9m 14s\n- swift-tox-py36 https://zuul.opendev.org/t/openstack/build/473de123ec6d4cabbce127399957bf37 : SUCCESS in 9m 46s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/d54ce9d5933347bdb7b94efeb494ed4c : FAILURE in 7m 24s (non-voting)\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/d0c737e9f74443eb88815c89d7f712a7 : SUCCESS in 7m 06s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/efe3033f2b4e47ff89cab18ba50d60e4 : SUCCESS in 7m 58s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/c68fbab578924eb9a95c885b1f4aa41e : SUCCESS in 7m 14s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/a08f084829f047beb0602e8846597270 : SUCCESS in 8m 40s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/81c032236ef245619b0ef82d8c1dc368 : FAILURE in 9m 34s\n- swift-tox-func-s3api-ceph-s3tests-tempauth https://zuul.opendev.org/t/openstack/build/862e877423be4d468c401ddc98f2a354 : POST_FAILURE in 5m 19s (non-voting)\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/1b2748628df842d19f080f30e404f62f : SUCCESS in 30m 55s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/54fd2b85066d42cd9c0428fecd35d38b : SUCCESS in 20m 55s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/778e7fc226d14cb38a9e435489da21fe : SUCCESS in 17m 29s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/a015ddf36bff42268eb19330e24727c3 : SUCCESS in 10m 13s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0a95bf6ca6a340618557e4453c2540d6 : SUCCESS in 5m 39s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/7e8e30093b9c465c8abfc1e3072ae5df : RETRY_LIMIT in 5m 31s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"95a7ca7ad446645b986d7fe679aa0ed13a954fbe","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-24 20:16:56.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"470dc9900e60e43639d79baff58c670417f8981c","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-24 20:28:34.000000000","message":"Uploaded patch set 5.","accounts_in_message":[],"_revision_number":5},{"id":"d59f9b94f764e90462280cd8ef03eb78a3f0c049","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-24 21:13:07.000000000","message":"Patch Set 5: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/def2b2c509ca40ce9c0e986827cb85f3\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/968742b191d8473698d6678cc0e8c147 : SUCCESS in 4m 12s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/6aee86f8f13348cf9128e590a396829a : SUCCESS in 8m 22s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/a5a3064f83ae4da086b96d9da541412e : SUCCESS in 6m 36s\n- swift-tox-py36 https://zuul.opendev.org/t/openstack/build/407cdc8238f448d6aa14dc93b3b66cb9 : SUCCESS in 6m 38s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/ad7877f2e604488482790a8cd583e710 : FAILURE in 4m 16s (non-voting)\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/99b91e9a44764dc3a2d25a2de8f39482 : SUCCESS in 6m 50s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/ef1cdb2ffc6b4f56a437cb0a0b86bb78 : SUCCESS in 8m 27s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/02384c8c368e485ea313477a126d9154 : SUCCESS in 7m 14s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/9c012fe7630740aa8e30c58d04912f39 : SUCCESS in 7m 15s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/c0fe12ae0dda4f5c87a90ecfb4b551ac : SUCCESS in 10m 15s\n- swift-tox-func-s3api-ceph-s3tests-tempauth https://zuul.opendev.org/t/openstack/build/72cb68b141de48009fdf133ee94e0c2d : POST_FAILURE in 4m 21s (non-voting)\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/70e6d27b93e9487eb27b8ecc9f483e64 : SUCCESS in 28m 09s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/a126833c2f90422ca09892037fd4514f : SUCCESS in 17m 59s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/7ef2a813f80249ba9c2e3bad03c32dd1 : SUCCESS in 17m 48s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/5888d53470fc4e8abab9708acdf2a4c6 : SUCCESS in 8m 21s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/bcbca7aaed384b9c988c8f0b1e0f7ecb : SUCCESS in 4m 42s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/c5c6ef2fb19e4e35a33822893416186e : RETRY_LIMIT in 6m 08s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"3d89c8e58646d32e0f002b746a657a1ed592cbdd","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-25 22:51:32.000000000","message":"Patch Set 5: Code-Review+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"eef9dd23a2bd45fd118f6f5a8ffbf78674dc7f7e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-25 22:52:09.000000000","message":"Patch Set 5: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":5},{"id":"ac55e5585e5cccc07e3cafc830738496422c0306","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-25 23:44:19.000000000","message":"Patch Set 5: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d040b727e86044eda41826550c629ae5\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e5482d3b7c9f44469dba3a8bdc7eb529 : SUCCESS in 6m 57s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/647860367f47422182ec4b382e7bfaa7 : SUCCESS in 11m 42s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/5b9e0eee858343a5966673b36c83a908 : SUCCESS in 10m 55s\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/2b52985e4be54326b0c5f6d34e2c21d4 : SUCCESS in 12m 24s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/26f3b08e24124cccb31eee717058c18d : SUCCESS in 12m 25s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/9817dea6d1b3419ca8937ac277f24c89 : SUCCESS in 9m 16s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/f8de5df893e4446583060fd24284845d : SUCCESS in 10m 00s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/dd60080a7b70422e9a764399ff9bee27 : SUCCESS in 12m 04s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/252a00989f0f458c8203ca664002aa33 : SUCCESS in 30m 44s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/1a3b83bd9eeb4a6094f21219ff315e36 : SUCCESS in 33m 31s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/df40e6bcfad243608891ec37821b1cd8 : SUCCESS in 28m 31s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/9dc730c8d4e247db939e30f38238895e : SUCCESS in 11m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/feb39977c862401cb8e77096443d76ad : SUCCESS in 5m 55s","accounts_in_message":[],"_revision_number":5},{"id":"bf0f64b047b2e6b9ddcd8cd24285407ee0a7361f","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-25 23:44:19.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":5},{"id":"fabc0b4135173d1295cc173cf0d42e61a3837437","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-25 23:45:35.000000000","message":"Patch Set 5:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8a93803698104b32b83133c184920d7b\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/18ad2d4e6e2a4ade9584e7caeabc65f1 : SUCCESS in 58s","accounts_in_message":[],"_revision_number":5}],"current_revision_number":5,"current_revision":"12e54391861e7d182d58f89fb88b027e65842640","revisions":{"fe08f6282d8bfee370bdaa03d7db714d839736c5":{"kind":"REWORK","_number":1,"created":"2023-01-23 20:46:10.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/01/871501/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/01/871501/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/01/871501/1"}}},"commit":{"parents":[{"commit":"c92b37e6d21c54a4142f997c24e2f8b87ca98959","subject":"Merge \"s3api: Use constant-time string comparisons in check_signature\" into stable/stein","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c92b37e6d21c54a4142f997c24e2f8b87ca98959"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tburke@nvidia.com","date":"2023-01-23 20:46:10.000000000","tz":0},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/fe08f6282d8bfee370bdaa03d7db714d839736c5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/fe08f6282d8bfee370bdaa03d7db714d839736c5"}]},"branch":"refs/heads/stable/stein"},"1e8bbd744682a31290cfec4b85442a300b3907dd":{"kind":"REWORK","_number":2,"created":"2023-01-23 21:19:10.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/01/871501/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/01/871501/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/01/871501/2"}}},"commit":{"parents":[{"commit":"c92b37e6d21c54a4142f997c24e2f8b87ca98959","subject":"Merge \"s3api: Use constant-time string comparisons in check_signature\" into stable/stein","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c92b37e6d21c54a4142f997c24e2f8b87ca98959"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2023-01-23 21:19:04.000000000","tz":-480},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/1e8bbd744682a31290cfec4b85442a300b3907dd"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/1e8bbd744682a31290cfec4b85442a300b3907dd"}]},"branch":"refs/heads/stable/stein"},"781c4f567f282dcbe160421a9fbe76ea379360ac":{"kind":"REWORK","_number":3,"created":"2023-01-23 21:35:31.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/01/871501/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/01/871501/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/01/871501/3"}}},"commit":{"parents":[{"commit":"c92b37e6d21c54a4142f997c24e2f8b87ca98959","subject":"Merge \"s3api: Use constant-time string comparisons in check_signature\" into stable/stein","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c92b37e6d21c54a4142f997c24e2f8b87ca98959"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2023-01-23 21:34:45.000000000","tz":-480},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/781c4f567f282dcbe160421a9fbe76ea379360ac"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/781c4f567f282dcbe160421a9fbe76ea379360ac"}]},"branch":"refs/heads/stable/stein"},"1bea44ae619f14ba48b8652d4c1ca401e252dca3":{"kind":"REWORK","_number":4,"created":"2023-01-24 20:16:56.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/01/871501/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/01/871501/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/01/871501/4"}}},"commit":{"parents":[{"commit":"c92b37e6d21c54a4142f997c24e2f8b87ca98959","subject":"Merge \"s3api: Use constant-time string comparisons in check_signature\" into stable/stein","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c92b37e6d21c54a4142f997c24e2f8b87ca98959"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2023-01-24 20:15:37.000000000","tz":-480},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/1bea44ae619f14ba48b8652d4c1ca401e252dca3"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/1bea44ae619f14ba48b8652d4c1ca401e252dca3"}]},"branch":"refs/heads/stable/stein"},"12e54391861e7d182d58f89fb88b027e65842640":{"kind":"REWORK","_number":5,"created":"2023-01-24 20:28:34.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/01/871501/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/01/871501/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/01/871501/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/01/871501/5"}}},"commit":{"parents":[{"commit":"c92b37e6d21c54a4142f997c24e2f8b87ca98959","subject":"Merge \"s3api: Use constant-time string comparisons in check_signature\" into stable/stein","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/c92b37e6d21c54a4142f997c24e2f8b87ca98959"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2023-01-24 20:28:28.000000000","tz":-480},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/12e54391861e7d182d58f89fb88b027e65842640"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/12e54391861e7d182d58f89fb88b027e65842640"}]},"branch":"refs/heads/stable/stein"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"OK","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"OK","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}},{"label":"Workflow","status":"OK","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}}]}],"submit_requirements":[]}