do not include context to exception notification

The wrap_exception decorator optionally emited a notification.
Based on the code comments the original intention was not to include the
context to that notification due to security reasons. However the
implementation did included the context to the payload of the legacy
notification.

Recently we saw circural reference errors during the payload serialization
of this notification. Based on the logs the only complex data structure
that could cause circural reference is the context. So this patch
removes the context from the legacy exception notification.

The versioned exception notification is not affected as it does not
contain the args of the decorated function.

Closes-Bug: #1673375
Change-Id: I1d217620e52d45595a3e0e49ed57b4ab33cd1688
(cherry picked from commit 3bf177a59cfd0b4e74dba256c3466ba2ea9bfbf7)

diff --git a/nova/exception_wrapper.py b/nova/exception_wrapper.py
index 9898898a05f0c9cada5f3a630f50314a81398da5..644da01630675ff342c965a0ea44929da6ebd0f1 100644 (file)
--- a/nova/exception_wrapper.py
+++ b/nova/exception_wrapper.py
@@ -86,6 +86,9 @@ def _get_call_dict(function, self, context, *args, **kw):
     # self can't be serialized and shouldn't be in the
     # payload
     call_dict.pop('self', None)
+    # NOTE(gibi) remove context as well as it contains sensitive information
+    # and it can also contain circular references
+    call_dict.pop('context', None)
     return _cleanse_dict(call_dict)
 
 

diff --git a/nova/tests/unit/test_exception.py b/nova/tests/unit/test_exception.py
index 07f99ed1d7a1968c7cdf5318d05bd91954a45abe..d3ae76161627f637ed77e9483d596b4a808c50d3 100644 (file)
--- a/nova/tests/unit/test_exception.py
+++ b/nova/tests/unit/test_exception.py
@@ -91,6 +91,7 @@ class WrapExceptionTestCase(test.NoDBTestCase):
         self.assertEqual(3, notification.payload['args']['extra'])
         for key in ['exception', 'args']:
             self.assertIn(key, notification.payload.keys())
+        self.assertNotIn('context', notification.payload['args'].keys())
 
         self.assertEqual(1, len(fake_notifier.VERSIONED_NOTIFICATIONS))
         notification = fake_notifier.VERSIONED_NOTIFICATIONS[0]