Backport #9663: Backport #9660 "django update broke pulpimport filestorage-usage" to 3.16.z - Pulp

Actions

Send by e-mail Copy link

Backport #9663

closed

Backport #9660 "django update broke pulpimport filestorage-usage" to 3.16.z

Added by ttereshc almost 3 years ago. Updated almost 3 years ago.

Status:

CLOSED - CURRENTRELEASE

Priority:

Normal

Assignee:

ttereshc

Category:

Sprint/Milestone:

3.16.2

Start date:

Due date:

% Done:

100%

Estimated time:

Triaged:

Sprint Candidate:

Tags:

Katello

Sprint:

Sprint 111

Quarter:

Description

Django addressed a security issue involving filepaths in a way that broke how pulpimport was using Storage:

In 3.14, the following failure in pulp_rpm.tests.functional.api.test_pulpimport.ParallelImportTestCase testMethod=test_clean_import :

E pulp_smash.pulp3.bindings.PulpTaskError: (PulpTaskError(...), "Pulp task failed (Detected path traversal attempt in '/var/lib/pulp/media/artifact/d4/89a5ea552e5ea595976e39f891fe249e95d8eb40cbd7f50a46c0126a7072ab')")

Against core/main, the same test hangs.

The problem is that core/import builds a full-path to send to Storage.save(), which used to "work" but is now Not Allowed (for perfectly good security-reasons)

See https://github.com/pulp/pulpcore/blob/main/pulpcore/app/tasks/importer.py#L396

Related issues