From 3eb0759a6d501348cf581e433f195aba3e548f5a Mon Sep 17 00:00:00 2001 From: Stanislav Levin Date: Mon, 16 Aug 2021 13:50:40 +0300 Subject: [PATCH] schema plugin: Generate stable fingerprint If some Param defines several values for `exclude` or `include` attributes then API schema hash will be unstable. First, these Param's attributes are converted to frozenset (ipalib/parameters.py), then `ipaserver.plugins.schema` plugin converts `exclude` and `include` attrs to list. Set/frozenset in turn, is unordered collection [0]. So, the end order of values is undefined. But due to the nature of sets: > two sets are equal if and only if every element of each set is contained in the other (each is a subset of the other) the order of values can be ignored. Note: other Param's attrs with type frozenset are not affected because they are not processed by the schema plugin. [0]: https://docs.python.org/3/library/stdtypes.html#set-types-set-frozenset Fixes: https://pagure.io/freeipa/issue/8955 Signed-off-by: Stanislav Levin Reviewed-By: Florence Blanc-Renaud Reviewed-By: Rob Crittenden --- ipaserver/plugins/schema.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipaserver/plugins/schema.py b/ipaserver/plugins/schema.py index 96e84d236..64f09852a 100644 --- a/ipaserver/plugins/schema.py +++ b/ipaserver/plugins/schema.py @@ -592,7 +592,7 @@ class param(BaseParam): obj[key] = unicode(value) elif key in ('exclude', 'include'): - obj[key] = list(unicode(v) for v in value) + obj[key] = sorted(list(unicode(v) for v in value)) if isinstance(metaobj, Command): if key == 'alwaysask': obj.setdefault(key, value)