** Tags removed: icehouse-backport-potential
** Changed in: keystone/icehouse
Status: In Progress => Won't Fix
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1379077
Title:
Tenants can be created with invalid ids
Status in Keystone:
In Progress
Status in Keystone icehouse series:
Won't Fix
Status in Keystone juno series:
Confirmed
Status in OpenStack Security Advisory:
Won't Fix
Bug description:
When creating a new tenant, there is an optional argument 'id' that
may be passed:
https://github.com/openstack/keystone/blob/9025b64a8f2bf5cf01a18453d6728e081bd2c3b9/keystone/assignment/controllers.py#L114
If not passed, this just creates a uuid and proceeds. If a value is
passed, it will use that value. So a user with priv's to create a
tenant can pass something like "../../../../../" as the id. If this
is done, then the project can't be deleted without manually removing
the value from the database. This can lead to a DoS that could fill
the db and take down the cloud, in the worst of circumstances.
I believe the proper fix here would be to just remove this feature
altogether. But this is because I'm not clear about why we would ever
want to allow someone to set the id manually. If there's a valid use
case here, then we should at least do some input validation.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1379077/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
