You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cloudstack.apache.org by Likitha Shetty <li...@citrix.com> on 2013/02/11 13:34:18 UTC
Re: Review Request: Non-printable characters such as %00 or %0025 are
getting stored in raw/non encoded form in the database
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/8876/
-----------------------------------------------------------
(Updated Feb. 11, 2013, 12:34 p.m.)
Review request for cloudstack, John Kinsella, Alena Prokharchyk, and Rohit Yadav.
Changes
-------
Thanks for reviewing John and sorry for the delayed response.
In the updated diff, for each of the parameter value the control characters are stripped out using ESAPI library. The new string that has been stripped out of control characters is compared with the original value. And if the two strings don't match an InvalidParameterValue error is thrown.
Since CloudStack allows for non-english characters, it didn't seem feasible to use getValidSafeHTML() method, isValidPrintable() or even a whitelisting pattern.
Please review and let me know if you have any suggestions.
Description
-------
Non-printable characters results in empty pages for all users loading the corrupted object in the web interface. It also results in the API call results getting truncated with an error when it encounters the non-printable characters.
To find if a parameter value contains a control character, every decoded parameter value was matched with the regex [\000-\037\177] as the ASCII non-printable characters are numbers 0 to 31 and 127 decimal.
This addresses bug CLOUDSTACK-863.
Diffs (updated)
-----
server/src/com/cloud/api/ApiServer.java d99d188
utils/pom.xml 937fad3
utils/src/com/cloud/utils/StringUtils.java 8f0a503
Diff: https://reviews.apache.org/r/8876/diff/
Testing
-------
Manual Testing done,
For sample API's (updateVirtualMachine, createVolume, authorizeSecurityGroupIngress etc), provide input values containing character(s) that are
• ASCII printable - pass
• ASCII non-printable - fail with error code 431 and error 'Received value <parameter-value> for parameter <parameter-name> is invalid, contains illegal ASCII non-printable characters'
• non-english - pass
Thanks,
Likitha Shetty
RE: Review Request: Non-printable characters such as %00 or %0025
are getting stored in raw/non encoded form in the database
Posted by Animesh Chaturvedi <an...@citrix.com>.
John a gentle reminder. We would like to clear the reviews in review board and every effort helps
> -----Original Message-----
> From: Animesh Chaturvedi [mailto:animesh.chaturvedi@citrix.com]
> Sent: Wednesday, February 13, 2013 7:26 PM
> To: cloudstack-dev@incubator.apache.org; Rohit Yadav; Alena Prokharchyk;
> John Kinsella
> Cc: Likitha Shetty
> Subject: RE: Review Request: Non-printable characters such as %00 or %0025
> are getting stored in raw/non encoded form in the database
>
> John
>
> Please review and if satisfied commit
>
> > -----Original Message-----
> > From: Rohit Yadav [mailto:noreply@reviews.apache.org] On Behalf Of
> > Rohit Yadav
> > Sent: Tuesday, February 12, 2013 12:10 AM
> > To: Rohit Yadav; Alena Prokharchyk; John Kinsella
> > Cc: cloudstack; Likitha Shetty
> > Subject: Re: Review Request: Non-printable characters such as %00 or
> > %0025 are getting stored in raw/non encoded form in the database
> >
> >
> > -----------------------------------------------------------
> > This is an automatically generated e-mail. To reply, visit:
> > https://reviews.apache.org/r/8876/#review16461
> > -----------------------------------------------------------
> >
> > Ship it!
> >
> >
> > Looks good, will wait for John to comment and let's have one final
> > review before we can commit it.
> >
> > - Rohit Yadav
> >
> >
> > On Feb. 11, 2013, 12:34 p.m., Likitha Shetty wrote:
> > >
> > > -----------------------------------------------------------
> > > This is an automatically generated e-mail. To reply, visit:
> > > https://reviews.apache.org/r/8876/
> > > -----------------------------------------------------------
> > >
> > > (Updated Feb. 11, 2013, 12:34 p.m.)
> > >
> > >
> > > Review request for cloudstack, John Kinsella, Alena Prokharchyk, and
> > > Rohit
> > Yadav.
> > >
> > >
> > > Description
> > > -------
> > >
> > > Non-printable characters results in empty pages for all users
> > > loading the
> > corrupted object in the web interface. It also results in the API call
> > results getting truncated with an error when it encounters the
> > non-printable characters.
> > > To find if a parameter value contains a control character, every
> > > decoded
> > parameter value was matched with the regex [\000-\037\177] as the
> > ASCII non- printable characters are numbers 0 to 31 and 127 decimal.
> > >
> > >
> > > This addresses bug CLOUDSTACK-863.
> > >
> > >
> > > Diffs
> > > -----
> > >
> > > server/src/com/cloud/api/ApiServer.java d99d188
> > > utils/pom.xml 937fad3
> > > utils/src/com/cloud/utils/StringUtils.java 8f0a503
> > >
> > > Diff: https://reviews.apache.org/r/8876/diff/
> > >
> > >
> > > Testing
> > > -------
> > >
> > > Manual Testing done,
> > > For sample API's (updateVirtualMachine, createVolume,
> > > authorizeSecurityGroupIngress etc), provide input values containing
> > > character(s) that are • ASCII printable - pass • ASCII non-printable
> > > - fail with
> > error code 431 and error 'Received value <parameter-value> for
> > parameter <parameter-name> is invalid, contains illegal ASCII non-printable
> characters'
> > > • non-english - pass
> > >
> > >
> > > Thanks,
> > >
> > > Likitha Shetty
> > >
> > >
RE: Review Request: Non-printable characters such as %00 or %0025
are getting stored in raw/non encoded form in the database
Posted by Animesh Chaturvedi <an...@citrix.com>.
John
Please review and if satisfied commit
> -----Original Message-----
> From: Rohit Yadav [mailto:noreply@reviews.apache.org] On Behalf Of Rohit
> Yadav
> Sent: Tuesday, February 12, 2013 12:10 AM
> To: Rohit Yadav; Alena Prokharchyk; John Kinsella
> Cc: cloudstack; Likitha Shetty
> Subject: Re: Review Request: Non-printable characters such as %00 or %0025
> are getting stored in raw/non encoded form in the database
>
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/8876/#review16461
> -----------------------------------------------------------
>
> Ship it!
>
>
> Looks good, will wait for John to comment and let's have one final review
> before we can commit it.
>
> - Rohit Yadav
>
>
> On Feb. 11, 2013, 12:34 p.m., Likitha Shetty wrote:
> >
> > -----------------------------------------------------------
> > This is an automatically generated e-mail. To reply, visit:
> > https://reviews.apache.org/r/8876/
> > -----------------------------------------------------------
> >
> > (Updated Feb. 11, 2013, 12:34 p.m.)
> >
> >
> > Review request for cloudstack, John Kinsella, Alena Prokharchyk, and Rohit
> Yadav.
> >
> >
> > Description
> > -------
> >
> > Non-printable characters results in empty pages for all users loading the
> corrupted object in the web interface. It also results in the API call results
> getting truncated with an error when it encounters the non-printable
> characters.
> > To find if a parameter value contains a control character, every decoded
> parameter value was matched with the regex [\000-\037\177] as the ASCII non-
> printable characters are numbers 0 to 31 and 127 decimal.
> >
> >
> > This addresses bug CLOUDSTACK-863.
> >
> >
> > Diffs
> > -----
> >
> > server/src/com/cloud/api/ApiServer.java d99d188
> > utils/pom.xml 937fad3
> > utils/src/com/cloud/utils/StringUtils.java 8f0a503
> >
> > Diff: https://reviews.apache.org/r/8876/diff/
> >
> >
> > Testing
> > -------
> >
> > Manual Testing done,
> > For sample API's (updateVirtualMachine, createVolume,
> > authorizeSecurityGroupIngress etc), provide input values containing
> > character(s) that are • ASCII printable - pass • ASCII non-printable - fail with
> error code 431 and error 'Received value <parameter-value> for parameter
> <parameter-name> is invalid, contains illegal ASCII non-printable characters'
> > • non-english - pass
> >
> >
> > Thanks,
> >
> > Likitha Shetty
> >
> >
Re: Review Request: Non-printable characters such as %00 or %0025 are
getting stored in raw/non encoded form in the database
Posted by Rohit Yadav <bh...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/8876/#review16461
-----------------------------------------------------------
Ship it!
Looks good, will wait for John to comment and let's have one final review before we can commit it.
- Rohit Yadav
On Feb. 11, 2013, 12:34 p.m., Likitha Shetty wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/8876/
> -----------------------------------------------------------
>
> (Updated Feb. 11, 2013, 12:34 p.m.)
>
>
> Review request for cloudstack, John Kinsella, Alena Prokharchyk, and Rohit Yadav.
>
>
> Description
> -------
>
> Non-printable characters results in empty pages for all users loading the corrupted object in the web interface. It also results in the API call results getting truncated with an error when it encounters the non-printable characters.
> To find if a parameter value contains a control character, every decoded parameter value was matched with the regex [\000-\037\177] as the ASCII non-printable characters are numbers 0 to 31 and 127 decimal.
>
>
> This addresses bug CLOUDSTACK-863.
>
>
> Diffs
> -----
>
> server/src/com/cloud/api/ApiServer.java d99d188
> utils/pom.xml 937fad3
> utils/src/com/cloud/utils/StringUtils.java 8f0a503
>
> Diff: https://reviews.apache.org/r/8876/diff/
>
>
> Testing
> -------
>
> Manual Testing done,
> For sample API's (updateVirtualMachine, createVolume, authorizeSecurityGroupIngress etc), provide input values containing character(s) that are
> • ASCII printable - pass
> • ASCII non-printable - fail with error code 431 and error 'Received value <parameter-value> for parameter <parameter-name> is invalid, contains illegal ASCII non-printable characters'
> • non-english - pass
>
>
> Thanks,
>
> Likitha Shetty
>
>
Re: Review Request: Non-printable characters such as %00 or %0025 are
getting stored in raw/non encoded form in the database
Posted by John Kinsella <jl...@stratosec.co>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/8876/#review16669
-----------------------------------------------------------
Ship it!
Ship It!
- John Kinsella
On Feb. 11, 2013, 12:34 p.m., Likitha Shetty wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/8876/
> -----------------------------------------------------------
>
> (Updated Feb. 11, 2013, 12:34 p.m.)
>
>
> Review request for cloudstack, John Kinsella, Alena Prokharchyk, and Rohit Yadav.
>
>
> Description
> -------
>
> Non-printable characters results in empty pages for all users loading the corrupted object in the web interface. It also results in the API call results getting truncated with an error when it encounters the non-printable characters.
> To find if a parameter value contains a control character, every decoded parameter value was matched with the regex [\000-\037\177] as the ASCII non-printable characters are numbers 0 to 31 and 127 decimal.
>
>
> This addresses bug CLOUDSTACK-863.
>
>
> Diffs
> -----
>
> server/src/com/cloud/api/ApiServer.java d99d188
> utils/pom.xml 937fad3
> utils/src/com/cloud/utils/StringUtils.java 8f0a503
>
> Diff: https://reviews.apache.org/r/8876/diff/
>
>
> Testing
> -------
>
> Manual Testing done,
> For sample API's (updateVirtualMachine, createVolume, authorizeSecurityGroupIngress etc), provide input values containing character(s) that are
> • ASCII printable - pass
> • ASCII non-printable - fail with error code 431 and error 'Received value <parameter-value> for parameter <parameter-name> is invalid, contains illegal ASCII non-printable characters'
> • non-english - pass
>
>
> Thanks,
>
> Likitha Shetty
>
>