Bug 973678 - The ISOImporter allows files named PULP_MANIFEST to be uploaded
Summary: The ISOImporter allows files named PULP_MANIFEST to be uploaded
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Pulp
Classification: Retired
Component: iso-support
Version: 2.2 Beta
Hardware: Unspecified
OS: Unspecified
urgent
unspecified
Target Milestone: ---
: 2.3.0
Assignee: Randy Barlow
QA Contact: Preethi Thomas
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-06-12 13:37 UTC by Randy Barlow
Modified: 2013-12-09 14:30 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-12-09 14:30:29 UTC
Embargoed:


Attachments (Terms of Use)

Description Randy Barlow 2013-06-12 13:37:59 UTC
It turns out that you can upload a file called PULP_MANIFEST as an ISO. This is bad because that filename is supposed to be reserved for the manifest.

During publishing, the units are symlinked after the manifest is written, so the uploaded file ends up overwriting the generated manifest.

The fix is simple - don't allow files named PULP_MANIFEST to be uploaded.

Comment 1 Randy Barlow 2013-09-05 15:38:29 UTC
https://github.com/pulp/pulp_rpm/pull/326

Comment 2 Jeff Ortel 2013-09-12 22:35:54 UTC
build: 2.3.0-0.10.alpha

Comment 3 Preethi Thomas 2013-09-20 12:15:45 UTC
Fails-qa

[root@pulp-v2-server ~]# rpm -qa pulp-server
pulp-server-2.3.0-0.14.alpha.el6.noarch
[root@pulp-v2-server ~]# 

It seems like there is still some issue with uploading the file PULP_MANIFEST

[root@pulp-v2-server ~]# pulp-admin iso repo uploads upload --repo-id iso --file PULP_MANIFEST -v
+----------------------------------------------------------------------+
                              Unit Upload
+----------------------------------------------------------------------+

Extracting necessary metadata for each request...
[==================================================] 100%
Analyzing: PULP_MANIFEST
... completed

Files to be uploaded:
  PULP_MANIFEST

Creating upload requests on the server...
[==================================================] 100%
Initializing: PULP_MANIFEST
... completed

Starting upload of selected units. If this process is stopped through ctrl+c,
the uploads will be paused and may be resumed later using the resume command or
cancelled entirely using the cancel command.

Uploading: PULP_MANIFEST
[==================================================] 100%
248/248 bytes
... completed

Importing into the repository...
The web server reported an error trying to access the Pulp application. The
likely cause is that the pulp-manage-db script has not been run prior to
starting the server. More information can be found in Apache's error log file on
the server itself.

[root@pulp-v2-server ~]# pulp-admin iso repo uploads list
+----------------------------------------------------------------------+
                            Upload Requests
+----------------------------------------------------------------------+

[ Paused  ] PULP_MANIFEST

Comment 4 Randy Barlow 2013-09-20 21:21:01 UTC
Hi Preethi! If I may, I'd suggest that this bug should be marked as VERIFIED as the error you see there is a separatly reported bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1004850

That bug tracks the fact that Pulp doesn't have any error handling mechanisms for Importers to report failure during an upload. It's because Pulp can't handle errors during upload that the error you found during verification happens.

This bug is about the Importer refusing to allow the PULP_MANIFEST file to be uploaded, and I would suggest that the goal that this bug was trying to achieve was successful.

Does that sound reasonable to you?

Comment 5 Preethi Thomas 2013-09-23 11:52:17 UTC
If thats the case I would think this bz is blocked by the other one for me to be able to verify it. 

For the user there is no way of saying whether this bz is fixed or not until there is a fix for the other one. 


I am also wondering why the PULP_MANIFEST should shows up as paused if its not allowed to upload.

Comment 6 Michael Hrivnak 2013-09-26 19:57:59 UTC
You can verify that there is not a new unit in the repo. The easiest way is to look at the content_unit_count shown by "pulp-admin iso repo list". Or you could do "pulp-admin iso repo isos --repo-id=example".

So I agree that this bug could be verified, because the importer does not allow a file named PULP_MANIFEST to be uploaded. It sucks that the error reporting is broken, but that's a separate (and less urgent) problem.

Comment 8 Jeff Ortel 2013-10-15 21:25:22 UTC
build: 2.3.0-0.21.beta

Comment 9 Preethi Thomas 2013-10-16 17:15:03 UTC
verified
[root@ibm-x3650m4-01-vm-16 ~]# rpm -qa |grep pulp-server
pulp-server-2.3.0-0.21.beta.fc19.noarch

[root@ibm-x3650m4-01-vm-16 ~]# 

[root@ibm-x3650m4-01-vm-16 ~]# pulp-admin iso repo create --repo-id iso 
Successfully created repository [iso]

[root@ibm-x3650m4-01-vm-16 ~]# pulp-admin iso repo uploads upload --repo-id iso --file PULP_MANIFEST -v
+----------------------------------------------------------------------+
                              Unit Upload
+----------------------------------------------------------------------+

Extracting necessary metadata for each request...
[==================================================] 100%
Analyzing: PULP_MANIFEST
... completed

Files to be uploaded:
  PULP_MANIFEST

Creating upload requests on the server...
[==================================================] 100%
Initializing: PULP_MANIFEST
... completed

Starting upload of selected units. If this process is stopped through ctrl+c,
the uploads will be paused and may be resumed later using the resume command or
cancelled entirely using the cancel command.

Uploading: PULP_MANIFEST
[==================================================] 100%
2/2 bytes
... completed

Importing into the repository...
... failed: An ISO may not be named PULP_MANIFEST, as it conflicts with the name
of the manifest during publishing.

Deleting the upload request...
... completed

[root@ibm-x3650m4-01-vm-16 ~]#

Comment 10 Preethi Thomas 2013-12-09 14:30:29 UTC
Pulp 2.3 released.


Note You need to log in before you can comment on or make changes to this bug.