)]}'
{"id":"openstack%2Fswift~871502","triplet_id":"openstack%2Fswift~stable%2Frocky~I84494123cfc85e234098c554ecd3e77981f8a096","project":"openstack/swift","branch":"stable/rocky","topic":"bug/1998625-stable/train-stable/stein-stable/rocky","attention_set":{},"removed_from_attention_set":{"15343":{"account":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"last_update":"2023-01-24 23:51:33.000000000","reason":"\u003cGERRIT_ACCOUNT_15343\u003e replied on the change","reason_account":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}}},"hashtags":[],"change_id":"I84494123cfc85e234098c554ecd3e77981f8a096","subject":"s3api: Prevent XXE injections","status":"MERGED","created":"2023-01-23 20:46:21.000000000","updated":"2023-01-26 02:59:41.000000000","submitted":"2023-01-26 02:59:41.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"871502-bug/1998625-stable/train-stable/stein-stable/rocky","cherry_pick_of_change":871501,"cherry_pick_of_patch_set":1,"meta_rev_id":"b069e8b1d5aa72473b81707f6c4af17c16ccc734","_number":871502,"virtual_id_number":871502,"owner":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2023-01-26 02:59:41.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2023-01-25 23:45:08.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2023-01-25 23:45:08.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":32333,"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@gmail.com","username":"AymericDu"}],"REVIEWER":[{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2023-01-23 20:46:21.000000000","updated_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"reviewer":{"_account_id":32333,"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@gmail.com","username":"AymericDu"},"state":"CC"},{"updated":"2023-01-23 22:00:39.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"78eb13c064387d42e9482c0e7caa70779c6069e1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-23 20:46:21.000000000","message":"Patch Set 1: Cherry Picked from branch stable/stein.","accounts_in_message":[],"_revision_number":1},{"id":"f8b17d381c8fa32fcbe3297400cfd24b89df83ef","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-23 22:00:39.000000000","message":"Patch Set 1: Verified-1\n\n(1 comment)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/30ba85d3958f41bfbba87337647e7b53\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/453952aba14b480f9eafa95fe28b037d : SUCCESS in 5m 23s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/e6355d655bd143f18dedb6ad41e8e8b5 : FAILURE in 9m 56s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/1975bf66388a4b50be0aed2bea07ce18 : SUCCESS in 4m 58s\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/a045d3273dc345629542fefa8cd554a6 : FAILURE in 9m 12s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/888731b67d194037913d7050b25b68f0 : FAILURE in 8m 53s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/6fc2276ad2d94df18dbc24bc8b031eb2 : FAILURE in 8m 41s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/8b0e28a061e949c0a4b1670d230033f4 : FAILURE in 13m 01s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/e288d391585e48c687c0caaf06a6ed1e : FAILURE in 10m 17s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/2b4e8d02d2254af8a0c9d1a984471022 : RETRY_LIMIT in 4m 07s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/1f2e5985957c48aa87cc02147f941c2e : FAILURE in 8m 26s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e8b5c7c2ddfe4442b4bcd0af547666e8 : FAILURE in 4m 45s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/a442d4205a1a43e583c25e33a9009b7d : FAILURE in 25m 59s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/44263376f0ae4aa9a87d09afb256862c : SUCCESS in 1h 11m 37s","accounts_in_message":[],"_revision_number":1},{"id":"d3d97ea7cbed6b535e56d5256dd6b1841ea6dfb1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-24 20:28:16.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"5787043aff0fa9f38d9830bdee329e9ecb9258ad","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-24 21:33:19.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/34a8c1c555ee40adba9be48ab66e7bb5\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/b6f642b09e4d45f593903ffe4818cbf0 : SUCCESS in 5m 32s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/8e813c4f75e44a14b7f9a3866b5520d3 : SUCCESS in 8m 24s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/1b16bfa9dfeb46b59b7065e4007a7fc9 : SUCCESS in 5m 28s\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/6b0f44a4e04049f4b5004aa4fe864469 : SUCCESS in 8m 33s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/a91316330bac483fb507305b7d2158d4 : SUCCESS in 7m 33s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/1af4912195964b7394e1a3b84b27b294 : SUCCESS in 7m 16s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/c5b58a95ffc242ada37ada418ef8ee54 : SUCCESS in 7m 54s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/bf656f77972a4b439e0022286cc449d1 : SUCCESS in 11m 10s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/b8f94d09d1224fefb1e1fe1df68f24b5 : RETRY_LIMIT in 2m 56s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/c5b72ef79f124bbba45c042b1f84724e : SUCCESS in 8m 05s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1ee8591aac4846d2b08602633583ee7e : SUCCESS in 5m 30s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/42016583fcd24ab28df538ec0796a0af : SUCCESS in 21m 32s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/36b0ee7a09c244f8946d7ec5f1edce27 : FAILURE in 56m 53s","accounts_in_message":[],"_revision_number":2},{"id":"016463b4d4ab8e8d44e9475fafb6918c10401d4d","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-24 21:37:40.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"b581e6ad998286f8dadc2959d3e724b92f7114c8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-24 23:18:51.000000000","message":"Patch Set 2:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/96acb36908e84a56a680b0fb30a1d7d9\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/0faf12b05ac74477af2fb7855a2d4f96 : SUCCESS in 5m 12s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/0e64de50d7f649d0b520a54c70889f3c : SUCCESS in 9m 53s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/b120b98da0d4421d8ac93668aa08e293 : SUCCESS in 5m 16s\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/d6535d4572f645a7ad4dcb01278b4c9b : SUCCESS in 9m 19s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/73ec7a6bfa2847fe86cff788b810777e : FAILURE in 10m 15s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/e85bf2f08fc94064812332f1541e3d7c : SUCCESS in 8m 27s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/ff949f4052af467e9d136b053d901e75 : SUCCESS in 9m 35s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/a05f3784e1714822b13715e1a7939be0 : SUCCESS in 9m 50s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/ab42c73106db4091b5da2f6d493acacd : RETRY_LIMIT in 3m 17s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/a336e9b87c164566ae08066786d0c8a3 : SUCCESS in 7m 22s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a220b16e08cf431f92fb099ac3a5d58d : SUCCESS in 5m 15s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/2e4dddc8843a47bd95b1e0b083d4c421 : SUCCESS in 34m 03s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/35e4b3e1095043be9d8a3047b9ff2b72 : SUCCESS in 1h 35m 37s","accounts_in_message":[],"_revision_number":2},{"id":"88c4a8f333fccf2563d532f5f9147d0dcf5d2a9d","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-24 23:51:33.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"055b12953c6a9abe314242bf9d470beacdba0dc7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-25 00:52:25.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c2189418914e48399ef6cb0f0a74d8cd\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/709a37482006494d95da44acf0aeae98 : SUCCESS in 5m 35s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/b1ba94b48fd144c4870b1a7c14a54184 : SUCCESS in 10m 49s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/3706a18d16ac4803918a5a7255515715 : SUCCESS in 6m 59s\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/a382f1846d8846f39c7318947ae3f1b9 : SUCCESS in 8m 53s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/de6fa6f02cbb4f12aef2d66b40606a81 : SUCCESS in 8m 45s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/ddda1948000c459a959fc30a6db944f9 : SUCCESS in 8m 25s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/049d865c943b4cd38375adecef07a381 : SUCCESS in 9m 14s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/937114784c0542b3a4b36eef09b25fbc : SUCCESS in 10m 30s\n- swift-probetests-centos-7 https://zuul.opendev.org/t/openstack/build/e4a961993a9946ce8d33a48dfaf61d5e : RETRY_LIMIT in 3m 02s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/585b68a9d52b44a59469b049e609b2d3 : SUCCESS in 8m 54s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f247d14caa8440f8abf318cd4ee1462a : SUCCESS in 5m 13s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/ac7ffc16355545fa825984aa97063e63 : SUCCESS in 18m 28s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/1d58343228314d079e7b5825023569b5 : SUCCESS in 58m 56s","accounts_in_message":[],"_revision_number":2},{"id":"2ad3856b46fbe7ce57f9793cee80dd011afca3ef","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2023-01-25 23:45:08.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"649a5fb617e94de907ec55aec3fe47b199700b29","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-25 23:46:12.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"312bf23386ad023b7bf057955c8d172ad22969d5","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-26 02:59:41.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2a23fc3d331842069f8bd280bf94b774\n\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/b9bb557845364df98b610c108ed7540c : SUCCESS in 6m 03s\n- swift-tox-py27 https://zuul.opendev.org/t/openstack/build/053342236d864ce28e5db6c9ea91219e : SUCCESS in 11m 33s\n- swift-tox-py35 https://zuul.opendev.org/t/openstack/build/666a10dc08a14d08a1d1eeb45cd8f698 : SUCCESS in 4m 58s\n- swift-tox-func-py27 https://zuul.opendev.org/t/openstack/build/470fe1c4f77149e3ac41059aca3d8108 : SUCCESS in 7m 52s\n- swift-tox-func-encryption-py27 https://zuul.opendev.org/t/openstack/build/58b2e2939f054cf5a6283151b5e2f794 : SUCCESS in 12m 51s\n- swift-tox-func-domain-remap-staticweb-py27 https://zuul.opendev.org/t/openstack/build/ee26a69b8b3c4ac69858fc607aaa8219 : SUCCESS in 11m 26s\n- swift-tox-func-ec-py27 https://zuul.opendev.org/t/openstack/build/03efacfde3754ddca084da82a5f5aa0f : SUCCESS in 6m 55s\n- swift-tox-func-s3api-py27 https://zuul.opendev.org/t/openstack/build/7ffd63330e7a47009671d751b1f3383f : SUCCESS in 11m 25s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/0ae48c5de5ab43b1b4d9240a9778a5ae : SUCCESS in 11m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5a161203f1f94b368a9c3fa6e2d7475e : SUCCESS in 5m 38s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/c9bb46faa6a34c7db912fe83fbf82a78 : SUCCESS in 19m 06s\n- legacy-tempest-dsvm-neutron-full https://zuul.opendev.org/t/openstack/build/b6f5c47af36944dca473a596c38ad06e : SUCCESS in 1h 25m 45s","accounts_in_message":[],"_revision_number":2},{"id":"b069e8b1d5aa72473b81707f6c4af17c16ccc734","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2023-01-26 02:59:41.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"f10672514217adadfc776d9ea2ffb20a37ce073b","revisions":{"128efbb1a94f9d8f162cfcf9bbf7b2db19f31a5e":{"kind":"REWORK","_number":1,"created":"2023-01-23 20:46:21.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/02/871502/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/02/871502/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/02/871502/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/02/871502/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/02/871502/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/02/871502/1"}}},"commit":{"parents":[{"commit":"76dd373a3dd3d32b7bf8ae65f920c51a1f117ffd","subject":"Fix docs-building on old stable branches","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/76dd373a3dd3d32b7bf8ae65f920c51a1f117ffd"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tburke@nvidia.com","date":"2023-01-23 20:46:21.000000000","tz":0},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/128efbb1a94f9d8f162cfcf9bbf7b2db19f31a5e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/128efbb1a94f9d8f162cfcf9bbf7b2db19f31a5e"}]},"branch":"refs/heads/stable/rocky"},"f10672514217adadfc776d9ea2ffb20a37ce073b":{"kind":"REWORK","_number":2,"created":"2023-01-24 20:28:16.000000000","uploader":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"ref":"refs/changes/02/871502/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/02/871502/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/02/871502/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/02/871502/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/02/871502/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/02/871502/2"}}},"commit":{"parents":[{"commit":"76dd373a3dd3d32b7bf8ae65f920c51a1f117ffd","subject":"Fix docs-building on old stable branches","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/76dd373a3dd3d32b7bf8ae65f920c51a1f117ffd"}]}],"author":{"name":"Aymeric Ducroquetz","email":"aymeric.ducroquetz@ovhcloud.com","date":"2022-10-25 20:07:53.000000000","tz":120},"committer":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2023-01-24 20:28:01.000000000","tz":-480},"subject":"s3api: Prevent XXE injections","message":"s3api: Prevent XXE injections\n\nPreviously, clients could use XML external entities (XXEs) to read\narbitrary files from proxy-servers and inject the content into the\nrequest. Since many S3 APIs reflect request content back to the user,\nthis could be used to extract any secrets that the swift user could\nread, such as tempauth credentials, keymaster secrets, etc.\n\nNow, disable entity resolution -- any unknown entities will be replaced\nwith an empty string. Without resolving the entities, the request is\nstill processed.\n\n[CVE-2022-47950]\n\nCloses-Bug: #1998625\nCo-Authored-By: Romain de Joux \u003cromain.de-joux@ovhcloud.com\u003e\nChange-Id: I84494123cfc85e234098c554ecd3e77981f8a096\n(cherry picked from commit b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/f10672514217adadfc776d9ea2ffb20a37ce073b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/f10672514217adadfc776d9ea2ffb20a37ce073b"}]},"branch":"refs/heads/stable/rocky"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"OK","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"OK","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}},{"label":"Workflow","status":"OK","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}}]}],"submit_requirements":[]}