Bug 973678 - The ISOImporter allows files named PULP_MANIFEST to be uploaded
The ISOImporter allows files named PULP_MANIFEST to be uploaded
Status: CLOSED CURRENTRELEASE
Product: Pulp
Classification: Community
Component: iso-support (Show other bugs)
2.2 Beta
Unspecified Unspecified
urgent Severity unspecified
: ---
: 2.3.0
Assigned To: Randy Barlow
Preethi Thomas
: Triaged
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-12 09:37 EDT by Randy Barlow
Modified: 2013-12-09 09:30 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-12-09 09:30:29 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Randy Barlow 2013-06-12 09:37:59 EDT
It turns out that you can upload a file called PULP_MANIFEST as an ISO. This is bad because that filename is supposed to be reserved for the manifest.

During publishing, the units are symlinked after the manifest is written, so the uploaded file ends up overwriting the generated manifest.

The fix is simple - don't allow files named PULP_MANIFEST to be uploaded.
Comment 1 Randy Barlow 2013-09-05 11:38:29 EDT
https://github.com/pulp/pulp_rpm/pull/326
Comment 2 Jeff Ortel 2013-09-12 18:35:54 EDT
build: 2.3.0-0.10.alpha
Comment 3 Preethi Thomas 2013-09-20 08:15:45 EDT
Fails-qa

[root@pulp-v2-server ~]# rpm -qa pulp-server
pulp-server-2.3.0-0.14.alpha.el6.noarch
[root@pulp-v2-server ~]# 

It seems like there is still some issue with uploading the file PULP_MANIFEST

[root@pulp-v2-server ~]# pulp-admin iso repo uploads upload --repo-id iso --file PULP_MANIFEST -v
+----------------------------------------------------------------------+
                              Unit Upload
+----------------------------------------------------------------------+

Extracting necessary metadata for each request...
[==================================================] 100%
Analyzing: PULP_MANIFEST
... completed

Files to be uploaded:
  PULP_MANIFEST

Creating upload requests on the server...
[==================================================] 100%
Initializing: PULP_MANIFEST
... completed

Starting upload of selected units. If this process is stopped through ctrl+c,
the uploads will be paused and may be resumed later using the resume command or
cancelled entirely using the cancel command.

Uploading: PULP_MANIFEST
[==================================================] 100%
248/248 bytes
... completed

Importing into the repository...
The web server reported an error trying to access the Pulp application. The
likely cause is that the pulp-manage-db script has not been run prior to
starting the server. More information can be found in Apache's error log file on
the server itself.

[root@pulp-v2-server ~]# pulp-admin iso repo uploads list
+----------------------------------------------------------------------+
                            Upload Requests
+----------------------------------------------------------------------+

[ Paused  ] PULP_MANIFEST
Comment 4 Randy Barlow 2013-09-20 17:21:01 EDT
Hi Preethi! If I may, I'd suggest that this bug should be marked as VERIFIED as the error you see there is a separatly reported bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1004850

That bug tracks the fact that Pulp doesn't have any error handling mechanisms for Importers to report failure during an upload. It's because Pulp can't handle errors during upload that the error you found during verification happens.

This bug is about the Importer refusing to allow the PULP_MANIFEST file to be uploaded, and I would suggest that the goal that this bug was trying to achieve was successful.

Does that sound reasonable to you?
Comment 5 Preethi Thomas 2013-09-23 07:52:17 EDT
If thats the case I would think this bz is blocked by the other one for me to be able to verify it. 

For the user there is no way of saying whether this bz is fixed or not until there is a fix for the other one. 


I am also wondering why the PULP_MANIFEST should shows up as paused if its not allowed to upload.
Comment 6 Michael Hrivnak 2013-09-26 15:57:59 EDT
You can verify that there is not a new unit in the repo. The easiest way is to look at the content_unit_count shown by "pulp-admin iso repo list". Or you could do "pulp-admin iso repo isos --repo-id=example".

So I agree that this bug could be verified, because the importer does not allow a file named PULP_MANIFEST to be uploaded. It sucks that the error reporting is broken, but that's a separate (and less urgent) problem.
Comment 8 Jeff Ortel 2013-10-15 17:25:22 EDT
build: 2.3.0-0.21.beta
Comment 9 Preethi Thomas 2013-10-16 13:15:03 EDT
verified
[root@ibm-x3650m4-01-vm-16 ~]# rpm -qa |grep pulp-server
pulp-server-2.3.0-0.21.beta.fc19.noarch

[root@ibm-x3650m4-01-vm-16 ~]# 

[root@ibm-x3650m4-01-vm-16 ~]# pulp-admin iso repo create --repo-id iso 
Successfully created repository [iso]

[root@ibm-x3650m4-01-vm-16 ~]# pulp-admin iso repo uploads upload --repo-id iso --file PULP_MANIFEST -v
+----------------------------------------------------------------------+
                              Unit Upload
+----------------------------------------------------------------------+

Extracting necessary metadata for each request...
[==================================================] 100%
Analyzing: PULP_MANIFEST
... completed

Files to be uploaded:
  PULP_MANIFEST

Creating upload requests on the server...
[==================================================] 100%
Initializing: PULP_MANIFEST
... completed

Starting upload of selected units. If this process is stopped through ctrl+c,
the uploads will be paused and may be resumed later using the resume command or
cancelled entirely using the cancel command.

Uploading: PULP_MANIFEST
[==================================================] 100%
2/2 bytes
... completed

Importing into the repository...
... failed: An ISO may not be named PULP_MANIFEST, as it conflicts with the name
of the manifest during publishing.

Deleting the upload request...
... completed

[root@ibm-x3650m4-01-vm-16 ~]#
Comment 10 Preethi Thomas 2013-12-09 09:30:29 EST
Pulp 2.3 released.

Note You need to log in before you can comment on or make changes to this bug.