swift 2.35.2__tar.gz → 2.35.4__tar.gz

{swift-2.35.2 → swift-2.35.4}/.mailmap

@@ -23,7 +23,8 @@ Chmouel Boudjnah <chmouel@enovance.com> <chmouel@chmouel.com>
 Gaurav B. Gangalwar <gaurav@gluster.com> gaurav@gluster.com <>
 Joe Arnold <joe@swiftstack.com> <joe@cloudscaling.com>
 Kapil Thangavelu <kapil.foss@gmail.com> kapil.foss@gmail.com <>
-Samuel Merritt <sam@swiftstack.com> <spam@andcheese.org>
+Samuel Merritt <smerritt@nvidia.com> <spam@andcheese.org>
+Samuel Merritt <smerritt@nvidia.com> <sam@swiftstack.com>
 Morita Kazutaka <morita.kazutaka@gmail.com>
 Zhongyue Luo <zhongyue.nah@intel.com> <lzyeval@gmail.com>
 Russ Nelson <russ@crynwr.com> <nelson@nelson-laptop>
@@ -52,8 +53,9 @@ Tom Fifield <tom@openstack.org> Tom Fifield <fifieldt@unimelb.edu.au>
 Sascha Peilicke <saschpe@gmx.de> Sascha Peilicke <saschpe@suse.de>
 Zhenguo Niu <zhenguo@unitedstack.com> <Niu.ZGlinux@gmail.com>
 Peter Portante <peter.portante@redhat.com> <peter.a.portante@gmail.com>
-Christian Schwede <cschwede@redhat.com> <info@cschwede.de>
-Christian Schwede <cschwede@redhat.com> <christian.schwede@enovance.com>
+Christian Schwede <cschwede@mailbox.org> <info@cschwede.de>
+Christian Schwede <cschwede@mailbox.org> <cschwede@redhat.com>
+Christian Schwede <cschwede@mailbox.org> <christian.schwede@enovance.com>
 Constantine Peresypkin <constantine.peresypk@rackspace.com> <constantine@litestack.com>
 Madhuri Kumari <madhuri.rai07@gmail.com> madhuri <madhuri@madhuri-VirtualBox.(none)>
 Morgan Fainberg <morgan.fainberg@gmail.com> <m@metacloud.com>
@@ -146,3 +148,4 @@ Chris Smart <distroguy@gmail.com> <chris.smart@humanservices.gov.au>
 Ashwin Nair <nairashwin952013@gmail.com> <ashnair@nvidia.com>
 Chinemerem Chigbo <chinemeremchigbo@Outlook.com> Chinemerem
 Chinemerem Chigbo <chinemeremchigbo@Outlook.com> <cchigbo@nvidia.com>
+Tim Burke <tim.burke@gmail.com> <tburke@nvidia.com>

{swift-2.35.2 → swift-2.35.4}/.zuul.yaml

@@ -349,6 +349,11 @@
       - tools/playbooks/cors/install_selenium.yaml
     run: tools/playbooks/cors/run.yaml
     post-run: tools/playbooks/cors/post.yaml
+    # TODO: OpenSSL 3.5.7 seems to have broken ansible's get_url, used to
+    #       fetch selenium's firefox driver. For more info, see
+    #       https://github.com/openssl/openssl/issues/31807
+    #       Make this voting again once it starts passing again.
+    voting: false
 
 - nodeset:
     name: swift-five-nodes-centos-9
@@ -463,7 +468,7 @@
     name: swift-multinode-rolling-upgrade-dalmatian
     parent: swift-multinode-rolling-upgrade
     vars:
-      previous_swift_version: origin/stable/2024.2
+      previous_swift_version: 2024.2-eol
       tox_envlist: func-py3
 
 - job:
@@ -575,6 +580,10 @@
     description: This is integrated object-storage job testing on Ubuntu jammy(22.04)
     parent: tempest-integrated-object-storage
     nodeset: openstack-single-node-jammy
+    vars:
+      devstack_localrc:
+        TEMPEST_VENV_UPPER_CONSTRAINTS: '/opt/stack/requirements/upper-constraints.txt'
+        TEMPEST_BRANCH: '46.3.0'
 
 - project-template:
     name: swift-jobs-arm64
@@ -688,10 +697,9 @@
             irrelevant-files: *tempest-irrelevant-files
         - openstacksdk-functional-devstack:
             irrelevant-files: *tempest-irrelevant-files
-        - grenade:
-            irrelevant-files: *tempest-irrelevant-files
-        - grenade-skip-level:
+        - grenade-skip-level-always:
             irrelevant-files: *tempest-irrelevant-files
+            voting: false
     gate:
       jobs:
         # For gate jobs, err towards running more jobs (so, generally avoid
@@ -730,10 +738,9 @@
             irrelevant-files: *tempest-irrelevant-files
         - openstacksdk-functional-devstack:
             irrelevant-files: *tempest-irrelevant-files
-        - grenade:
-            irrelevant-files: *tempest-irrelevant-files
-        - grenade-skip-level:
+        - grenade-skip-level-always:
             irrelevant-files: *tempest-irrelevant-files
+            voting: false
     experimental:
       jobs:
         - swift-tox-py37

{swift-2.35.2 → swift-2.35.4}/AUTHORS

@@ -31,7 +31,7 @@ Greg Lange (greglange@gmail.com)
 Janie Richling (jrichli@us.ibm.com)
 Michael Barton (mike@weirdlooking.com)
 Mahati Chamarthy (mahati.chamarthy@gmail.com)
-Samuel Merritt (sam@swiftstack.com)
+Samuel Merritt (smerritt@nvidia.com)
 Romain Le Disez (romain.ledisez@ovh.net)
 
 Contributors
@@ -107,7 +107,7 @@ Chris Smart (distroguy@gmail.com)
 Chris Wedgwood (cw@f00f.org)
 Christian Berendt (berendt@b1-systems.de)
 Christian Hugo (hugo.christian@web.de)
-Christian Schwede (cschwede@redhat.com)
+Christian Schwede (cschwede@mailbox.org)
 Christopher Bartz (bartz@dkrz.de)
 Christopher MacGown (chris@pistoncloud.com)
 Chuck Short (chuck.short@canonical.com)
@@ -390,7 +390,6 @@ Russ Nelson (russ@crynwr.com)
 Russell Bryant (rbryant@redhat.com)
 Sachin Patil (psachin@redhat.com)
 Sam Morrison (sorrison@gmail.com)
-Samuel Merritt (sam@swiftstack.com)
 Sarafraj Singh (Sarafraj.Singh@intel.com)
 Sarvesh Ranjan (saranjan@cisco.com)
 Sascha Peilicke (saschpe@gmx.de)

{swift-2.35.2 → swift-2.35.4}/CHANGELOG

@@ -1,3 +1,44 @@
+swift (2.35.4, epoxy stable backports)
+
+    * Fixed `Accept` header parsing to avoid excessive backtracking. Previously,
+      an unauthenticated user could send a malicious `Accept` header that would
+      keep a proxy-server process pegged at 100% CPU for several seconds.
+      Repeated requests would exhaust all available workers, leading to a
+      complete denial of service. Refer to CVE-2026-71190 for more information.
+
+    * Require that more `x-amz-*` headers be included in the set of signed
+      headers if present in an S3 API request. Previously an attacker could include
+      an unsigned `x-amz-copy-source` header with a valid presigned PUT to
+      copy arbitrary data accessible by the signer provided that the container
+      and object name were known. This required the default `s3_acl = False`
+      configuration. Refer to CVE-2026-71191 for more information.
+
+    * Limit native Swift control headers from S3 API requests. Previously these
+      could allow an attacker to copy arbitrary data to a bucket they control
+      provided they know the account, container, and object name to copy. This
+      required the non-default `s3_acl = True` configuration. Refer to
+      CVE-2026-71192 for more information.
+
+    * Prevent a crash when `AF_ALG` socket creation is denied by policy (such
+      as may be the case with recent versions of Docker).
+
+swift (2.35.3, epoxy stable backports)
+
+    * Block client-supplied container-update headers. Previously, these could
+      be used to perform server-side request forgery (SSRF) attacks. Refer to
+      CVE-2026-50221 for more information.
+
+    * Restrict the types of data that may be sent between object servers and
+      replicators. Previously, if an object server were compromised, it could
+      use REPLICATE responses to attempt to compromise other nodes through
+      their replicators.
+
+    * Fixed an infinite loop in s3api when attempting to read from a truncated
+      aws-chunked input. This could be used as a Denial-of-Service vector
+      as the proxy-server process stopped handling other requests. Refer to
+      CVE-2026-49017 for more information.
+
+
 swift (2.35.2, epoxy stable backports)
 
     * The s3token middleware now passes service auth tokens to Keystone

{swift-2.35.2/swift.egg-info → swift-2.35.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swift
-Version: 2.35.2
+Version: 2.35.4
 Summary: OpenStack Object Storage
 Home-page: https://docs.openstack.org/swift/latest/
 Author: OpenStack

swift-2.35.4/releasenotes/notes/release-2.35.3-48f117a536316b56.yaml

@@ -0,0 +1,20 @@
+---
+security:
+  - |
+    Block client-supplied container-update headers. Previously, these could
+    be used to perform server-side request forgery (SSRF) attacks. Refer to
+    `CVE-2026-50221 <https://www.cve.org/CVERecord?id=CVE-2026-50221>`__ for
+    more information.
+
+  - |
+    Restrict the types of data that may be sent between object servers and
+    replicators. Previously, if an object server were compromised, it could
+    use REPLICATE responses to attempt to compromise other nodes through
+    their replicators.
+
+  - |
+    Fixed an infinite loop when attempting to read from a truncated
+    aws-chunked input. This could be used as a Denial-of-Service vector
+    as the proxy-server process stopped handling other requests. Refer to
+    `CVE-2026-49017 <https://www.cve.org/CVERecord?id=CVE-2026-49017>`__ for
+    more information.

swift-2.35.4/releasenotes/notes/release-2.35.4-3205ae28c1240697.yaml

@@ -0,0 +1,33 @@
+---
+security:
+  - |
+    Fixed ``Accept`` header parsing to avoid excessive backtracking. Previously,
+    an unauthenticated user could send a malicious ``Accept`` header that would
+    keep a proxy-server process pegged at 100% CPU for several seconds.
+    Repeated requests would exhaust all available workers, leading to a
+    complete denial of service. Refer to
+    `CVE-2026-71190 <https://www.cve.org/CVERecord?id=CVE-2026-71190>`__
+    for more information.
+
+  - |
+    Require that more ``x-amz-*`` headers be included in the set of signed
+    headers if present in an S3 API request. Previously an attacker could include
+    an unsigned ``x-amz-copy-source`` header with a valid presigned PUT to
+    copy arbitrary data accessible by the signer provided that the container
+    and object name were known. This required the default ``s3_acl = False``
+    configuration. Refer to
+    `CVE-2026-71191 <https://www.cve.org/CVERecord?id=CVE-2026-71191>`__
+    for more information.
+
+  - |
+    Limit native Swift control headers from S3 API requests. Previously these
+    could allow an attacker to copy arbitrary data to a bucket they control
+    provided they know the account, container, and object name to copy. This
+    required the non-default ``s3_acl = True`` configuration. Refer to
+    `CVE-2026-71192 <https://www.cve.org/CVERecord?id=CVE-2026-71192>`__
+    for more information.
+
+fixes:
+  - |
+    Prevent a crash when ``AF_ALG`` socket creation is denied by policy (such
+    as may be the case with recent versions of Docker).

{swift-2.35.2 → swift-2.35.4}/swift/common/db.py

@@ -31,6 +31,7 @@ import sqlite3
 
 from swift.common.constraints import MAX_META_COUNT, MAX_META_OVERALL_SIZE, \
     check_utf8
+from swift.common.utils.pickle import unpickle
 from swift.common.utils import Timestamp, renamer, \
     mkdirs, lock_parent_directory, fallocate, md5
 from swift.common.exceptions import LockTimeout
@@ -832,8 +833,8 @@ class DatabaseBroker(object):
             for entry in fp.read().split(b':'):
                 if entry:
                     try:
-                        data = pickle.loads(base64.b64decode(entry),
-                                            encoding='utf8')  # nosec: B301
+                        data = unpickle(base64.b64decode(entry),
+                                        encoding='utf8')
                         self._commit_puts_load(item_list, data)
                     except Exception:
                         self.logger.exception(

{swift-2.35.2 → swift-2.35.4}/swift/common/direct_client.py

@@ -23,7 +23,6 @@ import os
 import socket
 
 from eventlet import sleep, Timeout
-import pickle  # nosec: B403
 from http.client import HTTPException
 
 from swift.common.bufferedhttp import http_connect, http_connect_raw
@@ -31,6 +30,7 @@ from swift.common.exceptions import ClientException
 from swift.common.request_helpers import USE_REPLICATION_NETWORK_HEADER, \
     get_ip_port
 from swift.common.swob import normalize_etag
+from swift.common.utils.pickle import unpickle
 from swift.common.utils import Timestamp, FileLikeIter, quote
 from swift.common.http import HTTP_NO_CONTENT, HTTP_INSUFFICIENT_STORAGE, \
     is_success, is_server_error
@@ -656,7 +656,7 @@ def direct_get_suffix_hashes(node, part, suffixes, conn_timeout=5,
                                     host={'ip': node['replication_ip'],
                                           'port': node['replication_port']}
                                     )
-    return pickle.loads(resp.read())  # nosec: B301
+    return unpickle(resp.read())
 
 
 def retry(func, *args, **kwargs):

{swift-2.35.2 → swift-2.35.4}/swift/common/middleware/gatekeeper.py

@@ -48,11 +48,17 @@ import re
 # If adding to this list, note that these are regex patterns,
 # so use a trailing $ to constrain to an exact header match
 # rather than prefix match.
-inbound_exclusions = [get_sys_meta_prefix('account'),
-                      get_sys_meta_prefix('container'),
-                      get_sys_meta_prefix('object'),
-                      OBJECT_TRANSIENT_SYSMETA_PREFIX,
-                      'x-backend']
+inbound_exclusions = [
+    get_sys_meta_prefix('account'),
+    get_sys_meta_prefix('container'),
+    get_sys_meta_prefix('object'),
+    OBJECT_TRANSIENT_SYSMETA_PREFIX,
+    'x-backend',
+    # Block any update headers that predate x-backend headers
+    'x-account-(host|device|partition)$',
+    'x-container-(host|device|partition|root-db-state)$',
+    'x-delete-at-(host|device|partition|container)$',
+]
 
 
 #: A list of python regular expressions that will be used to

{swift-2.35.2 → swift-2.35.4}/swift/common/middleware/s3api/s3request.py

@@ -94,6 +94,24 @@ SIGV4_CHUNK_MIN_SIZE = 8192
 SERVICE = 's3'  # useful for mocking out in tests
 
 
+SIGV4_MUST_BE_SIGNED_AMZ_PREFIXES = (
+    'x-amz-copy',
+    'x-amz-acl',
+    'x-amz-grant',
+    'x-amz-meta',
+)
+
+
+DISALLOWED_CLIENT_HEADERS = frozenset((
+    'x-copy-from',
+    'x-copy-from-account',
+    'x-symlink-target',
+    'x-symlink-target-account',
+    'x-object-manifest',
+    'x-static-large-object',
+))
+
+
 CHECKSUMS_BY_HEADER = {
     'x-amz-checksum-crc32': checksum.crc32,
     'x-amz-checksum-crc32c': checksum.crc32c,
@@ -430,6 +448,8 @@ class StreamingInput:
             self._to_read -= len(buf)
             if readline and buf[-1:] == b'\n':
                 break
+            if not buf and not self._completed_payload:
+                raise S3InputIncomplete
         return b''.join(bufs)
 
     def _read_trailers(self):
@@ -922,6 +942,14 @@ class SigV4Mixin(object):
                 (k.lower().strip(), ' '.join(_header_strip(v or '').split()))
                 for (k, v) in self.headers.items())
 
+        for key in headers_lower_dict:
+            key = swob.wsgi_to_str(key)
+            if (key not in self._signed_headers
+                    and key.startswith(SIGV4_MUST_BE_SIGNED_AMZ_PREFIXES)):
+                raise AccessDenied(
+                    'There were headers present in the request which were '
+                    'not signed', headers_not_signed=key)
+
         if 'host' in headers_lower_dict and re.match(
                 'Boto/2.[0-9].[0-2]',
                 headers_lower_dict.get('user-agent', '')):
@@ -1103,6 +1131,10 @@ class S3Request(swob.Request):
         # by full URL when absolute path given. See swift.swob for more detail.
         self.environ['swift.leave_relative_location'] = True
 
+        for header in list(self.headers):
+            if header.lower() in DISALLOWED_CLIENT_HEADERS:
+                self.headers.pop(header, None)
+
     def validate_part_number(self, parts_count=None, check_max=True):
         """
         Get the partNumber param, if it exists, and check it is valid.

{swift-2.35.2 → swift-2.35.4}/swift/common/swob.py

@@ -697,7 +697,7 @@ class Accept(object):
 
     # RFC 2616 section 2.2
     token = r'[^()<>@,;:\"/\[\]?={}\x00-\x20\x7f]+'  # nosec B105
-    qdtext = r'[^"]'
+    qdtext = r'[^"\\]'
     quoted_pair = r'(?:\\.)'
     quoted_string = r'"(?:' + qdtext + r'|' + quoted_pair + r')*"'
     extension = (r'(?:\s*;\s*(?:' + token + r")\s*=\s*" + r'(?:' + token +

{swift-2.35.2 → swift-2.35.4}/swift/common/utils/__init__.py

@@ -42,7 +42,7 @@ from optparse import OptionParser
 import traceback
 import warnings
 
-from tempfile import gettempdir, mkstemp, NamedTemporaryFile
+from tempfile import gettempdir, NamedTemporaryFile
 import glob
 import itertools
 import stat
@@ -64,7 +64,6 @@ from eventlet.green import socket
 import eventlet.hubs
 import eventlet.queue
 
-import pickle  # nosec: B403
 from configparser import (ConfigParser, NoSectionError,
                           NoOptionError)
 from urllib.parse import unquote, urlparse
@@ -1501,28 +1500,6 @@ def cache_from_env(env, allow_none=False):
     return item_from_env(env, 'swift.cache', allow_none)
 
 
-def write_pickle(obj, dest, tmp=None, pickle_protocol=0):
-    """
-    Ensure that a pickle file gets written to disk.  The file
-    is first written to a tmp location, ensure it is synced to disk, then
-    perform a move to its final location
-
-    :param obj: python object to be pickled
-    :param dest: path of final destination file
-    :param tmp: path to tmp to use, defaults to None
-    :param pickle_protocol: protocol to pickle the obj with, defaults to 0
-    """
-    if tmp is None:
-        tmp = os.path.dirname(dest)
-    mkdirs(tmp)
-    fd, tmppath = mkstemp(dir=tmp, suffix='.tmp')
-    with os.fdopen(fd, 'wb') as fo:
-        pickle.dump(obj, fo, pickle_protocol)
-        fo.flush()
-        os.fsync(fd)
-        renamer(tmppath, dest)
-
-
 def search_tree(root, glob_match, ext='', exts=None, dir_ext=None):
     """Look in root, for any files/dirs matching glob, recursively traversing
     any found directories looking for files ending with ext

{swift-2.35.2 → swift-2.35.4}/swift/common/utils/checksum.py

@@ -106,7 +106,8 @@ except OSError as e:
     if e.errno == errno.ENOENT:
         # could create socket, but crc32c is unknown
         _sock.close()
-    elif e.errno != errno.EAFNOSUPPORT:
+    elif e.errno not in (errno.EAFNOSUPPORT, errno.EPERM, errno.EACCES):
+        # EPERM/EACCES: sandboxes such as Docker >= 29 deny AF_ALG
         raise
     crc32c_kern = None
 else:

swift-2.35.4/swift/common/utils/pickle.py

@@ -0,0 +1,77 @@
+# Copyright (c) 2010-2026 OpenStack Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import _codecs
+import copyreg
+import io
+import os
+import pickle  # nosec: B403
+from tempfile import mkstemp
+
+from swift.common import header_key_dict
+from swift.common.utils import mkdirs, renamer
+
+
+def write_pickle(obj, dest, tmp=None, pickle_protocol=0):
+    """
+    Ensure that a pickle file gets written to disk.  The file
+    is first written to a tmp location, ensure it is synced to disk, then
+    perform a move to its final location
+
+    :param obj: python object to be pickled
+    :param dest: path of final destination file
+    :param tmp: path to tmp to use, defaults to None
+    :param pickle_protocol: protocol to pickle the obj with, defaults to 0
+    """
+    if tmp is None:
+        tmp = os.path.dirname(dest)
+    mkdirs(tmp)
+    fd, tmppath = mkstemp(dir=tmp, suffix='.tmp')
+    with os.fdopen(fd, 'wb') as fo:
+        pickle.dump(obj, fo, pickle_protocol)
+        fo.flush()
+        os.fsync(fd)
+        renamer(tmppath, dest)
+
+
+_ALLOWED_GLOBALS = {
+    ('_codecs', 'encode'): _codecs.encode,
+    # Needed for HeaderKeyDict
+    ('copy_reg', '_reconstructor'): copyreg._reconstructor,
+    ('copyreg', '_reconstructor'): copyreg._reconstructor,
+    ('swift.common.header_key_dict', 'HeaderKeyDict'):
+        header_key_dict.HeaderKeyDict,
+    ('builtins', 'dict'): dict,
+    ('__builtin__', 'dict'): dict,
+    ('builtins', 'bytes'): bytes,
+    ('__builtin__', 'bytes'): bytes,
+}
+
+
+class RestrictedUnpickler(pickle.Unpickler):
+    def find_class(self, module, name):
+        try:
+            return _ALLOWED_GLOBALS[(module, name)]
+        except KeyError:
+            # Forbid any other loading
+            raise pickle.UnpicklingError(
+                f"global '{module}.{name}' is forbidden")
+
+
+def unpickle(source, encoding='ASCII'):
+    """Helper function analogous to pickle.loads()."""
+    if isinstance(source, bytes):
+        source = io.BytesIO(source)
+    return RestrictedUnpickler(source, encoding=encoding).load()

{swift-2.35.2 → swift-2.35.4}/swift/container/backend.py

@@ -746,7 +746,8 @@ class ContainerBroker(DatabaseBroker):
         Mark an object deleted.
 
         :param name: object name to be deleted
-        :param timestamp: timestamp when the object was marked as deleted
+        :param timestamp: string representation of the timestamp when the
+            object was marked as deleted
         :param storage_policy_index: the storage policy index for the object
         """
         self.put_object(name, timestamp, 0, 'application/deleted', 'noetag',
@@ -766,16 +767,18 @@ class ContainerBroker(DatabaseBroker):
         Creates an object in the DB with its metadata.
 
         :param name: object name to be created
-        :param timestamp: timestamp of when the object was created
+        :param timestamp: string representation of the timestamp when the
+            object was created
         :param size: object size
         :param content_type: object content-type
         :param etag: object etag
         :param deleted: if True, marks the object as deleted and sets the
                         deleted_at timestamp to timestamp
         :param storage_policy_index: the storage policy index for the object
-        :param ctype_timestamp: timestamp of when content_type was last
-                                updated
-        :param meta_timestamp: timestamp of when metadata was last updated
+        :param ctype_timestamp: string representation of the timestamp when
+            content_type was last updated, or None
+        :param meta_timestamp: string representation of the timestamp when
+            metadata was last updated, or None
         """
         record = {'name': name, 'created_at': timestamp, 'size': size,
                   'content_type': content_type, 'etag': etag,

{swift-2.35.2 → swift-2.35.4}/swift/obj/diskfile.py

@@ -57,9 +57,10 @@ from pyeclib.ec_iface import ECDriverError, ECInvalidFragmentMetadata, \
 
 from swift.common.constraints import check_drive
 from swift.common.request_helpers import is_sys_meta
+from swift.common.utils.pickle import unpickle, write_pickle
 from swift.common.utils import mkdirs, Timestamp, \
     storage_directory, hash_path, renamer, fallocate, fsync, fdatasync, \
-    fsync_dir, drop_buffer_cache, lock_path, write_pickle, \
+    fsync_dir, drop_buffer_cache, lock_path, \
     config_true_value, listdir, split_path, remove_file, \
     get_md5_socket, F_SETPIPE_SZ, decode_timestamps, encode_timestamps, \
     MD5_OF_EMPTY_STRING, link_fd_to_path, \
@@ -237,7 +238,7 @@ def read_metadata(fd, add_missing_checksum=False):
     # strings are utf-8 encoded when written, but have not always been
     # (see https://bugs.launchpad.net/swift/+bug/1678018) so encode them again
     # when read
-    metadata = pickle.loads(metadata, encoding='bytes')  # nosec: B301
+    metadata = unpickle(metadata, encoding='bytes')
     return _decode_metadata(metadata, metadata_written_by_py3)
 
 
@@ -360,7 +361,7 @@ def read_hashes(partition_dir):
         pass
     else:
         try:
-            hashes = pickle.loads(pickled_hashes)  # nosec: B301
+            hashes = unpickle(pickled_hashes)
         except Exception:
             # pickle.loads() can raise a wide variety of exceptions when
             # given invalid input depending on the way in which the

{swift-2.35.2 → swift-2.35.4}/swift/obj/reconstructor.py

@@ -21,7 +21,6 @@ from os.path import join
 import random
 import time
 from collections import defaultdict
-import pickle  # nosec: B403
 import shutil
 
 from eventlet import (GreenPile, GreenPool, Timeout, sleep, tpool, spawn)
@@ -34,6 +33,7 @@ from swift.common.utils import (
     load_recon_cache, parse_override_options, distribute_evenly,
     remove_directory, config_request_node_count_value,
     non_negative_int, get_prefixed_logger)
+from swift.common.utils.pickle import unpickle
 from swift.common.header_key_dict import HeaderKeyDict
 from swift.common.bufferedhttp import http_connect
 from swift.common.daemon import Daemon, run_daemon
@@ -934,7 +934,7 @@ class ObjectReconstructor(Daemon):
                         "Invalid response %(resp)s from %(full_path)s",
                         {'resp': resp.status, 'full_path': full_path})
                 else:
-                    remote_suffixes = pickle.loads(resp.read())  # nosec: B301
+                    remote_suffixes = unpickle(resp.read())
             except (Exception, Timeout):
                 # all exceptions are logged here so that our caller can
                 # safely catch our exception and continue to the next node

{swift-2.35.2 → swift-2.35.4}/swift/obj/replicator.py

@@ -22,7 +22,6 @@ import random
 import shutil
 import time
 import itertools
-import pickle  # nosec: B403
 
 import eventlet
 from eventlet import GreenPool, queue, tpool, Timeout, sleep
@@ -36,6 +35,7 @@ from swift.common.utils import whataremyips, unlink_older_than, \
     config_auto_int_value, storage_directory, load_recon_cache, EUCLEAN, \
     parse_override_options, distribute_evenly, listdir, node_to_string, \
     get_prefixed_logger
+from swift.common.utils.pickle import unpickle
 from swift.common.bufferedhttp import http_connect
 from swift.common.daemon import Daemon, run_daemon
 from swift.common.http import HTTP_OK, HTTP_INSUFFICIENT_STORAGE
@@ -709,8 +709,7 @@ class ObjectReplicator(Daemon):
                                 failure_devs_info.add((node['replication_ip'],
                                                        node['device']))
                                 continue
-                            remote_hash = pickle.loads(
-                                resp.read())  # nosec: B301
+                            remote_hash = unpickle(resp.read())
                         finally:
                             conn.close()
                         del resp

{swift-2.35.2 → swift-2.35.4}/swift/obj/updater.py

@@ -14,7 +14,6 @@
 # limitations under the License.
 import queue
 
-import pickle  # nosec: B403
 import errno
 import os
 import signal
@@ -31,7 +30,8 @@ from swift.common.bufferedhttp import http_connect
 from swift.common.constraints import check_drive
 from swift.common.exceptions import ConnectionTimeout
 from swift.common.ring import Ring
-from swift.common.utils import get_logger, renamer, write_pickle, \
+from swift.common.utils.pickle import unpickle, write_pickle
+from swift.common.utils import get_logger, renamer, \
     dump_recon_cache, config_true_value, RateLimitedIterator, split_path, \
     eventlet_monkey_patch, get_redirect_data, ContextPool, hash_path, \
     non_negative_float, config_positive_int_value, non_negative_int, \
@@ -645,13 +645,22 @@ class ObjectUpdater(Daemon):
         )
 
     def _load_update(self, device, update_path):
+        pickle_data = None
         try:
-            return pickle.load(open(update_path, 'rb'))  # nosec: B301
+            with open(update_path, 'rb') as fp:
+                pickle_data = fp.read()
+            return unpickle(pickle_data)
         except Exception as e:
             if getattr(e, 'errno', None) == errno.ENOENT:
-                return
-            self.logger.exception(
-                'ERROR Pickle problem, quarantining %s', update_path)
+                return None
+            if pickle_data is None:
+                self.logger.exception(
+                    'ERROR Pickle problem reading, quarantining %s',
+                    update_path)
+            else:
+                self.logger.exception(
+                    'ERROR Pickle problem unpickling, quarantining %s',
+                    update_path)
             self.stats.quarantines += 1
             self.logger.increment('quarantines')
             target_path = os.path.join(device, 'quarantined', 'objects',
@@ -664,7 +673,7 @@ class ObjectUpdater(Daemon):
                 os.rmdir(os.path.dirname(update_path))
             except OSError:
                 pass
-            return
+            return None
 
     def _iter_async_pendings(self, device):
         """