joystick

#9 [secaudit,blocking] The source image location is fully trusted from the message
Closed by puiterwijk. Opened by puiterwijk.

Closed
Reopen Issue

In joystick/consumers/fedora_messaging_consumer.py, line 57, the source location for the images are taken and fully trusted from the message, which together with #7 means that any tool that ends its messages with a particular topic can upload any file as a fully trusted Fedora AWS image.

The image location is actually formed on the plume side through the configs. You can find the config here: https://github.com/coreos/mantle/blob/master/cmd/plume/fedora.go#L79

Here in config the image is believed to stay in https://github.com/coreos/mantle/blob/master/cmd/plume/fedora.go#L79

Metadata Update from @puiterwijk:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.