delta/openstack/swift.git/test/functional, branch master

tests: Skip s3api functional tests when no s3api user configured

2023-03-10T22:07:21+00:00

Change-Id: I61f141a71eddcac600058d66ddf802306df455c1

tests: Let func tests run with test users 1 and 2 but not 3

2023-03-10T22:07:21+00:00

Change-Id: Ia564f2ee70f5d04acab1c38e17d1936642a01447

Merge "tests: Get rid of test.unit.SkipTest"

2023-02-28T02:20:04+00:00

Merge "Skip S3 versioning test when versioning is not enabled"

2023-02-25T07:27:09+00:00

encryption: Expose decrypted metadata via CORS

2023-02-24T21:24:16+00:00

Normally, the proxy object controller would be adding these, but when
encrypted, there won't be any headers in the x-object-meta-* namespace.

Closes-Bug: #1868045
Change-Id: I8e708a60ee63f679056300fc9d68227e46d605e8

Skip S3 versioning test when versioning is not enabled

2023-02-24T19:48:13+00:00

Change-Id: I36e42f459a74ed71a1cc57570a564e5562abbae3

tests: Get rid of test.unit.SkipTest

2023-02-17T07:59:53+00:00

unittest.SkipTest suffices.

Change-Id: I11eb73f7dc4a8598fae85d1efca721f69067fb4f

tests: Fix some func tests to do with metadata maximums

2023-02-02T23:34:00+00:00

Previously, if a cluster's combined configured max_meta_name_length and
max_meta_value_length constraints were larger than the configured
max_meta_overall_size, we would accidentally go over the overall size
while intending to just test being exactly at the value length-limit.

Change-Id: I42a5287011509e5b43959aab060f9ec7405ae5b9

tests: Ensure XXE injection tests have config loaded

2023-01-19T19:24:34+00:00

Depending on test order (and possibly whether there were earlier
failures?) the new tests may trip KeyErrors when trying to get
s3_access_key values. Solution seems to be defining
setUpModule() / tearDownModule() like other functional tests.

Also fix up some Content-MD5 handling; if we're using pre-signed URLs,
we can't provide a Content-MD5.

Change-Id: Ifce72ec255b1b618b9914ce5785d04ee0ebd3b8c
Related-Change: I84494123cfc85e234098c554ecd3e77981f8a096

s3api: Prevent XXE injections

2023-01-17T15:03:41+00:00

Previously, clients could use XML external entities (XXEs) to read
arbitrary files from proxy-servers and inject the content into the
request. Since many S3 APIs reflect request content back to the user,
this could be used to extract any secrets that the swift user could
read, such as tempauth credentials, keymaster secrets, etc.

Now, disable entity resolution -- any unknown entities will be replaced
with an empty string. Without resolving the entities, the request is
still processed.

[CVE-2022-47950]

Closes-Bug: #1998625
Co-Authored-By: Romain de Joux 
Change-Id: I84494123cfc85e234098c554ecd3e77981f8a096