[nacoool]

Problem

When organization_id or location_id are passed as top-level parameters to the images API (e.g., via hammer compute-resource image create), they were incorrectly being used as the nested parent object instead of compute_resource_id, causing a NoMethodError:

NoMethodError: undefined method 'images' for #<Organization id: 1, name: "NAME"...>

This occurred because parent_resource_details in base_controller.rb was iterating over all parameters ending with _id, rather than only those explicitly allowed via allowed_nested_id.

Root Cause

In app/controllers/api/base_controller.rb, the parent_resource_details method was selecting all params ending with _id:

params.select { |param| param.ends_with?('_id') }.each do |param, value|

This meant that organization_id and location_id could be selected as the parent resource before compute_resource_id, leading to the controller trying to call .images on an Organization or Location object (which don't have that association).

Solution

Modified parent_resource_details to only consider parameters that are explicitly listed in the controller's allowed_nested_id method:

params.select { |param| allowed_nested_id.include?(param.to_s) }.each do |param, value|

This ensures that only valid nested resource IDs are used as parent objects.

[evgeni]

@nacoool can you please fix the rubocop issues and add a redmine?

[lzap]

It is a bit unclear to me how do I reproduce the issue, is it just hammer compute-resource image create like that? I bet this command is missing key options... Will dig deeper but let me know if you can fill me in. Cheers.

[lzap]

Reproduced:

[lzapleta@yuki ~]$ hammer compute-resource image create --name test --compute-resource libvirt --username root --uuid /scratch/images/rhcos-4.22.8-x86_64-live-iso.x86_64.iso --operatingsystem-id 1 --architecture x86_64 --organization-id 1

Could not create the image:
  Internal Server Error: the server was unable to finish the request. This may be caused by unavailability of some required service, incorrect API call or a server-side bug. There may be more information in the server's logs.

Taking a closer look.

[lzap]

Tested, image created with this.

I see no security implications. The only concern I have is how to prevent such issues in the future when we implement a nested controller.

[lhellebr]

This has caused a regression: https://redhat.atlassian.net/browse/SAT-52699