Bug 973678

Summary: The ISOImporter allows files named PULP_MANIFEST to be uploaded
Product: [Retired] Pulp Reporter: Randy Barlow <rbarlow>
Component: iso-supportAssignee: Randy Barlow <rbarlow>
Status: CLOSED CURRENTRELEASE QA Contact: Preethi Thomas <pthomas>
Severity: unspecified Docs Contact:
Priority: urgent    
Version: 2.2 BetaCC: jason.dobies, mhrivnak, pthomas
Target Milestone: ---Keywords: Triaged
Target Release: 2.3.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-12-09 14:30:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Randy Barlow 2013-06-12 13:37:59 UTC
It turns out that you can upload a file called PULP_MANIFEST as an ISO. This is bad because that filename is supposed to be reserved for the manifest.

During publishing, the units are symlinked after the manifest is written, so the uploaded file ends up overwriting the generated manifest.

The fix is simple - don't allow files named PULP_MANIFEST to be uploaded.

Comment 1 Randy Barlow 2013-09-05 15:38:29 UTC
https://github.com/pulp/pulp_rpm/pull/326

Comment 2 Jeff Ortel 2013-09-12 22:35:54 UTC
build: 2.3.0-0.10.alpha

Comment 3 Preethi Thomas 2013-09-20 12:15:45 UTC
Fails-qa

[root@pulp-v2-server ~]# rpm -qa pulp-server
pulp-server-2.3.0-0.14.alpha.el6.noarch
[root@pulp-v2-server ~]# 

It seems like there is still some issue with uploading the file PULP_MANIFEST

[root@pulp-v2-server ~]# pulp-admin iso repo uploads upload --repo-id iso --file PULP_MANIFEST -v
+----------------------------------------------------------------------+
                              Unit Upload
+----------------------------------------------------------------------+

Extracting necessary metadata for each request...
[==================================================] 100%
Analyzing: PULP_MANIFEST
... completed

Files to be uploaded:
  PULP_MANIFEST

Creating upload requests on the server...
[==================================================] 100%
Initializing: PULP_MANIFEST
... completed

Starting upload of selected units. If this process is stopped through ctrl+c,
the uploads will be paused and may be resumed later using the resume command or
cancelled entirely using the cancel command.

Uploading: PULP_MANIFEST
[==================================================] 100%
248/248 bytes
... completed

Importing into the repository...
The web server reported an error trying to access the Pulp application. The
likely cause is that the pulp-manage-db script has not been run prior to
starting the server. More information can be found in Apache's error log file on
the server itself.

[root@pulp-v2-server ~]# pulp-admin iso repo uploads list
+----------------------------------------------------------------------+
                            Upload Requests
+----------------------------------------------------------------------+

[ Paused  ] PULP_MANIFEST

Comment 4 Randy Barlow 2013-09-20 21:21:01 UTC
Hi Preethi! If I may, I'd suggest that this bug should be marked as VERIFIED as the error you see there is a separatly reported bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1004850

That bug tracks the fact that Pulp doesn't have any error handling mechanisms for Importers to report failure during an upload. It's because Pulp can't handle errors during upload that the error you found during verification happens.

This bug is about the Importer refusing to allow the PULP_MANIFEST file to be uploaded, and I would suggest that the goal that this bug was trying to achieve was successful.

Does that sound reasonable to you?

Comment 5 Preethi Thomas 2013-09-23 11:52:17 UTC
If thats the case I would think this bz is blocked by the other one for me to be able to verify it. 

For the user there is no way of saying whether this bz is fixed or not until there is a fix for the other one. 


I am also wondering why the PULP_MANIFEST should shows up as paused if its not allowed to upload.

Comment 6 Michael Hrivnak 2013-09-26 19:57:59 UTC
You can verify that there is not a new unit in the repo. The easiest way is to look at the content_unit_count shown by "pulp-admin iso repo list". Or you could do "pulp-admin iso repo isos --repo-id=example".

So I agree that this bug could be verified, because the importer does not allow a file named PULP_MANIFEST to be uploaded. It sucks that the error reporting is broken, but that's a separate (and less urgent) problem.

Comment 8 Jeff Ortel 2013-10-15 21:25:22 UTC
build: 2.3.0-0.21.beta

Comment 9 Preethi Thomas 2013-10-16 17:15:03 UTC
verified
[root@ibm-x3650m4-01-vm-16 ~]# rpm -qa |grep pulp-server
pulp-server-2.3.0-0.21.beta.fc19.noarch

[root@ibm-x3650m4-01-vm-16 ~]# 

[root@ibm-x3650m4-01-vm-16 ~]# pulp-admin iso repo create --repo-id iso 
Successfully created repository [iso]

[root@ibm-x3650m4-01-vm-16 ~]# pulp-admin iso repo uploads upload --repo-id iso --file PULP_MANIFEST -v
+----------------------------------------------------------------------+
                              Unit Upload
+----------------------------------------------------------------------+

Extracting necessary metadata for each request...
[==================================================] 100%
Analyzing: PULP_MANIFEST
... completed

Files to be uploaded:
  PULP_MANIFEST

Creating upload requests on the server...
[==================================================] 100%
Initializing: PULP_MANIFEST
... completed

Starting upload of selected units. If this process is stopped through ctrl+c,
the uploads will be paused and may be resumed later using the resume command or
cancelled entirely using the cancel command.

Uploading: PULP_MANIFEST
[==================================================] 100%
2/2 bytes
... completed

Importing into the repository...
... failed: An ISO may not be named PULP_MANIFEST, as it conflicts with the name
of the manifest during publishing.

Deleting the upload request...
... completed

[root@ibm-x3650m4-01-vm-16 ~]#

Comment 10 Preethi Thomas 2013-12-09 14:30:29 UTC
Pulp 2.3 released.