Use utils.safe_minidom_parse_string in extensions

Use utils.safe_minidom_parse_string in extensions that were still
using potentially-unsafe minidom.

Fixes bug 1190229

Change-Id: I43afb2e188bbea99ea30fe6cb2eb1aeedc4ddfd4

diff --git a/cinder/api/contrib/backups.py b/cinder/api/contrib/backups.py
index c41b637d95d8cf8a2aa755255e675eae9ee56e8b..6c67b2db752af11b3ee356f13a57b2758c6ab40a 100644 (file)
--- a/cinder/api/contrib/backups.py
+++ b/cinder/api/contrib/backups.py
@@ -18,7 +18,6 @@
 
 import webob
 from webob import exc
-from xml.dom import minidom
 
 from cinder.api import common
 from cinder.api import extensions
@@ -28,6 +27,7 @@ from cinder.api import xmlutil
 from cinder import backup as backupAPI
 from cinder import exception
 from cinder.openstack.common import log as logging
+from cinder import utils
 
 
 LOG = logging.getLogger(__name__)
@@ -82,7 +82,7 @@ class BackupRestoreTemplate(xmlutil.TemplateBuilder):
 
 class CreateDeserializer(wsgi.MetadataXMLDeserializer):
     def default(self, string):
-        dom = minidom.parseString(string)
+        dom = utils.safe_minidom_parse_string(string)
         backup = self._extract_backup(dom)
         return {'body': {'backup': backup}}
 
@@ -101,7 +101,7 @@ class CreateDeserializer(wsgi.MetadataXMLDeserializer):
 
 class RestoreDeserializer(wsgi.MetadataXMLDeserializer):
     def default(self, string):
-        dom = minidom.parseString(string)
+        dom = utils.safe_minidom_parse_string(string)
         restore = self._extract_restore(dom)
         return {'body': {'restore': restore}}
 

diff --git a/cinder/api/contrib/volume_transfer.py b/cinder/api/contrib/volume_transfer.py
index 543ddbef0719290e4ba1af0ef27f6b2555ee3992..e21cd05f2b4c3632c3a6a0697bca927d6ffeae6b 100644 (file)
--- a/cinder/api/contrib/volume_transfer.py
+++ b/cinder/api/contrib/volume_transfer.py
@@ -17,7 +17,6 @@
 
 import webob
 from webob import exc
-from xml.dom import minidom
 
 from cinder.api import common
 from cinder.api import extensions
@@ -28,6 +27,7 @@ from cinder.api import xmlutil
 from cinder import exception
 from cinder.openstack.common import log as logging
 from cinder import transfer as transferAPI
+from cinder import utils
 
 LOG = logging.getLogger(__name__)
 
@@ -62,7 +62,7 @@ class TransfersTemplate(xmlutil.TemplateBuilder):
 
 class CreateDeserializer(wsgi.MetadataXMLDeserializer):
     def default(self, string):
-        dom = minidom.parseString(string)
+        dom = utils.safe_minidom_parse_string(string)
         transfer = self._extract_transfer(dom)
         return {'body': {'transfer': transfer}}
 
@@ -80,7 +80,7 @@ class CreateDeserializer(wsgi.MetadataXMLDeserializer):
 
 class AcceptDeserializer(wsgi.MetadataXMLDeserializer):
     def default(self, string):
-        dom = minidom.parseString(string)
+        dom = utils.safe_minidom_parse_string(string)
         transfer = self._extract_transfer(dom)
         return {'body': {'accept': transfer}}