From e9d21589d39355ffc126e360cc2ba7311e014edb Mon Sep 17 00:00:00 2001
From: Eoghan Glynn <eglynn@redhat.com>
Date: Fri, 6 Jul 2012 10:10:28 +0000
Subject: Expose over-quota exceptions via native API.

Fixes bug LP 1021373.

Previously an over-quota condition would be exposed via the EC2 API,
but hidden in the corresponding call via the native API (in the sense
of the exception detail being replaced with a generic 500 Server Error
response).

We now report any NovaException declared to be safe. In this patch,
the set of safe exception types includes any subclass of QuotaError,
but in subsequent patches the net should be widened to include
exceptions that do not expose senstive information.

Change-Id: I3cc36337c7e67cf487ca49de646c437c217ae538
---
 nova/tests/api/openstack/compute/test_api.py | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'nova/tests')

diff --git a/nova/tests/api/openstack/compute/test_api.py b/nova/tests/api/openstack/compute/test_api.py
index 434befdb9..a1dd01be3 100644
--- a/nova/tests/api/openstack/compute/test_api.py
+++ b/nova/tests/api/openstack/compute/test_api.py
@@ -23,6 +23,7 @@ import webob.exc
 from nova.api import openstack as openstack_api
 from nova.api.openstack import wsgi
 import nova.context
+from nova import exception
 from nova.openstack.common import jsonutils
 from nova import test
 from nova.tests.api.openstack import fakes
@@ -120,6 +121,29 @@ class APITest(test.TestCase):
         self.assertTrue('<computeFault' in resp.body, resp.body)
         self.assertEqual(resp.status_int, 500, resp.body)
 
+    def _do_test_exception_safety_reflected_in_faults(self, expose):
+        class ExceptionWithSafety(exception.NovaException):
+            safe = expose
+
+        @webob.dec.wsgify
+        def fail(req):
+            raise ExceptionWithSafety('some explanation')
+
+        api = self._wsgi_app(fail)
+        resp = webob.Request.blank('/').get_response(api)
+        self.assertTrue('{"computeFault' in resp.body, resp.body)
+        expected = ('ExceptionWithSafety: some explanation' if expose else
+                    'The server has either erred or is incapable '
+                    'of performing the requested operation.')
+        self.assertTrue(expected in resp.body, resp.body)
+        self.assertEqual(resp.status_int, 500, resp.body)
+
+    def test_safe_exceptions_are_described_in_faults(self):
+        self._do_test_exception_safety_reflected_in_faults(True)
+
+    def test_unsafe_exceptions_are_not_described_in_faults(self):
+        self._do_test_exception_safety_reflected_in_faults(False)
+
     def test_request_id_in_response(self):
         req = webob.Request.blank('/')
         req.method = 'GET'
-- 
cgit