Comment 33 for bug 1400966

About Havana:

I think havana is not affected:

Here Icehouse fix: https://review.openstack.org/#/c/142788/3/glance/api/v1/images.py

And this is havana code:

    def _validate_source(source, req):
        if source:
            for scheme in ['s3', 'swift', 'http', 'rbd', 'sheepdog', 'cinder']:
                if source.lower().startswith(scheme):
                    return source
            msg = _("External sourcing not supported for store %s") % source
            raise HTTPBadRequest(explanation=msg, bla-bla-bla

Basically, havana will not accept anything except listed ('s3', 'swift', 'http', 'rbd', 'sheepdog', 'cinder'), and will rejects schemes 'file' and 'swift+config'.