No api parameter validation.

Bug #1083684 reported by Jay Payne
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Cinder
Invalid
High
Mike Perez

Bug Description

You can pass a list instead of a single snapshot id. In the example below a list of snapshot ids was passed to the api instead of a single value. A 400 should probably be returned.

cinder/api01.com.log:Nov 26 22:05:24.498977 api01.com 2012-11-26 22:05:24 ERROR cinder.api.openstack [req-db68f728-883b] Caught error: (ProgrammingError) (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') \n LIMIT 1' at line 3")

'SELECT snapshots.created_at AS snapshots_created_at,
  snapshots.updated_at AS snapshots_updated_at,
  snapshots.deleted_at AS snapshots_deleted_at,
  snapshots.deleted AS snapshots_deleted,
  snapshots.id AS snapshots_id,
  snapshots.user_id AS snapshots_user_id,
  snapshots.project_id AS snapshots_project_id,
  snapshots.volume_id AS snapshots_volume_id,
  snapshots.status AS snapshots_status,
  snapshots.progress AS snapshots_progress,
  snapshots.volume_size AS snapshots_volume_size,
  snapshots.display_name AS snapshots_display_name,
  snapshots.display_description AS snapshots_display_description \n
FROM snapshots \n
WHERE snapshots.deleted = %s
AND snapshots.project_id = %s
AND snapshots.id = %s \n
LIMIT %s' (0, '11', [u'9b82eff1-32ca-4dbd-8724-4f80a25a66c9'], 1)

POST http://api.com/v1/11/volumes
cinder/api01.com.log:Nov 26 22:05:24.498977 api01.com 2012-11-26 22:05:24 ERROR cinder.api.openstack [req-db68f728-883b] Caught error: (ProgrammingError) (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') \n LIMIT 1' at line 3") 'SELECT snapshots.created_at AS snapshots_created_at, snapshots.updated_at AS snapshots_updated_at, snapshots.deleted_at AS snapshots_deleted_at, snapshots.deleted AS snapshots_deleted, snapshots.id AS snapshots_id, snapshots.user_id AS snapshots_user_id, snapshots.project_id AS snapshots_project_id, snapshots.volume_id AS snapshots_volume_id, snapshots.status AS snapshots_status, snapshots.progress AS snapshots_progress, snapshots.volume_size AS snapshots_volume_size, snapshots.display_name AS snapshots_display_name, snapshots.display_description AS snapshots_display_description \nFROM snapshots \nWHERE snapshots.deleted = %s AND snapshots.project_id = %s AND snapshots.id = %s \n LIMIT %s' (0, '11', [u'9b82eff1-32ca-4dbd-8724-4f80a25a66c9'], 1)
cinder/api01.com.log:Nov 26 22:05:24.500444 api01.com 2012-11-26 22:05:24 INFO cinder.api.openstack [req-db68f728-883b] http://api.com/v1/11/volumes returned with HTTP 500

Jay Payne (letterj)
description: updated
Changed in cinder:
status: New → Confirmed
milestone: none → grizzly-2
importance: Undecided → High
Revision history for this message
Mike Perez (thingee) wrote :

I see that you created a volume with POST /volumes and then it throws a 500. How exactly did it get multiple snapshot ids associated with it before creation? Can you provide the list of steps to reproduce? Thanks!

Mike Perez (thingee)
Changed in cinder:
status: Confirmed → Incomplete
assignee: nobody → Mike Perez (thingee)
Changed in cinder:
milestone: grizzly-2 → none
Revision history for this message
Chuck Short (zulcss) wrote :

This bug lacks the necessary information to effectively reproduce and
fix it, therefore it has been closed. We should reopen the bug by when
we have more information and set the bug status back to ''New''.

Changed in cinder:
status: Incomplete → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.