Skip to content

IHDC-346: update the config creation logic to avoid the injection - #94

Merged
colorzzr merged 2 commits into
hdcfrom
IHDC-346
Sep 6, 2023
Merged

IHDC-346: update the config creation logic to avoid the injection#94
colorzzr merged 2 commits into
hdcfrom
IHDC-346

Conversation

@colorzzr

@colorzzr colorzzr commented Sep 6, 2023

Copy link
Copy Markdown
Member

Summary

The old logic of configuration directly use the os.system() to execute the touch {} command, which will cause the potential risk of script injection. To avoid this, replace the system command with python pathlib library.

refer the pilot update: #70

JIRA Issues

IHDC-346

Type of Change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • Refactor or reformatting

Testing

Are there any new or updated tests to validate the changes?

  • Yes
  • No

Test Directions

@colorzzr
colorzzr requested a review from Samantha77 September 6, 2023 14:27
@colorzzr colorzzr self-assigned this Sep 6, 2023
@github-actions

github-actions Bot commented Sep 6, 2023

Copy link
Copy Markdown
Contributor

Coverage

Coverage Report
FileStmtsMissCoverMissing
__init__.py00100% 
pilotcli.py0290%5–6, 8–12, 15–19, 21–26, 29–37, 40–41
commands
   __init__.py00100% 
   container_registry.py0470%5, 7–10, 13–14, 16, 19–24, 27–33, 36–44, 47–53, 56–65
   dataset.py0860%5–6, 8–13, 16–17, 19, 22–25, 34–38, 41–48, 50–60, 63–67, 76–80, 83–91, 93–103, 106–109, 117–127, 129–130
   entry_point.py01020%5, 7, 9–10, 12–25, 28–39, 41–42, 45–51, 54–56, 59–63, 66–70, 73–77, 80–83, 86–88, 91–94, 97–114, 117, 119–121, 123–129, 131, 133–135, 137
   file.py07264%37, 142, 146, 165, 167, 169–172, 214, 216, 294–301, 303, 305, 319–325, 327, 354–361, 363, 397–403, 406–407, 409–410, 412–424, 426–428, 430, 433–435, 437–439
   hpc.py01230%5, 7–17, 20–21, 23, 26–29, 36–40, 42–45, 47–49, 51, 53–61, 64–72, 75–84, 87–100, 103–117, 120–132, 134–137, 140–153, 155–157
   kg_resource.py0130%5, 7–9, 12–13, 15, 18–23
   project.py0390%5–6, 8–11, 14–15, 17, 20–23, 31, 39, 48–52, 55–62, 64–74
   use_config.py0130%5, 7–9, 12–13, 15, 18–20, 27–29
   user.py0300%5, 7–9, 12–15, 18–19, 21, 42–48, 50, 52, 55–56, 58, 61–62, 71–75
configs
   __init__.py00100% 
   app_config.py00100% 
   user_config.py01579%50, 60, 64, 68, 72, 76, 80, 84, 88, 92, 96, 100, 104, 108, 112
models
   __init__.py00100% 
   convert_type.py080%5, 7, 10–15
   service_meta_class.py0280%9, 16
   singleton.py00100% 
   upload_form.py02860%12, 27, 31, 35, 39, 43, 47, 51, 55, 59, 63, 67, 71, 75, 79, 83, 87, 91, 95, 99, 127, 140–146
resources
   custom_error.py00100% 
   custom_help.py00100% 
services
   __init__.py00100% 
services/crypto
   __init__.py00100% 
   crypto.py01940%35, 43–47, 49, 59–61, 69–75, 77, 79
services/dataset_manager
   dataset_detail.py02370%42, 44, 61, 68–73, 75–77, 79–88, 90
   dataset_list.py0683%37, 43–44, 46–48
services/file_manager
   __init__.py00100% 
   file_lineage.py0741%13–14, 23, 26–28, 30
   file_list.py04827%25–29, 31–34, 37, 45–60, 63–65, 69–75, 77–88
   file_manifests.py09525%19–24, 39–43, 47–48, 51–59, 61, 65–68, 71–75, 77, 81–82, 85–87, 91–92, 95–102, 104, 107, 109–110, 112–113, 115–118, 123–129, 134–139, 142–148, 150–152, 155–161, 163–165, 167–170
   file_tag.py03931%23, 27–31, 33, 36–48, 50–52, 54–55, 59–61, 64–68, 70–73, 75–76
services/file_manager/file_download
   __init__.py00100% 
   download_client.py018617%29–41, 44–45, 47–53, 56–57, 59–60, 69, 71–72, 76–79, 86, 91–94, 96, 98–105, 107, 109, 113–118, 120, 123–124, 127–129, 131–133, 135–136, 138–140, 144–152, 155–160, 164–173, 181–183, 185–192, 194–198, 203–213, 215–216, 219–220, 225–226, 230–235, 239–240, 243–245, 247–258, 262–265, 268–272, 274–276, 278–280, 282–283, 285, 289–291, 293–306, 308
   model.py0187%15
services/file_manager/file_upload
   __init__.py00100% 
   exception.py0175%10
   file_upload.py05960%33–40, 74, 104, 135–136, 140, 142, 144–146, 148, 150, 163–166, 168–170, 174, 176–180, 184, 192–196, 199, 203, 207–208, 210–211, 213–215, 217–222, 224–225, 227, 285, 288, 292
   models.py0591%23, 41, 147–149
   upload_client.py08655%102–105, 169–171, 184, 186–191, 193–197, 200, 202–214, 216, 259, 262, 266, 268–271, 275–280, 282, 286, 288, 290, 292, 310, 335–336, 341, 345–348, 352, 368–370, 372–374, 383, 388–389, 391, 393–394, 396–399, 401, 415–421, 431
   upload_validator.py02650%27–29, 32–34, 38–42, 45–54, 57–58, 63, 65, 67
services/hpc_manager
   hpc_auth.py00100% 
   hpc_cluster.py06832%34–37, 39–40, 42, 46–58, 60–64, 66–67, 72–74, 76–77, 81–93, 95–99, 101–102, 106–118, 120–121, 123
services/kg_manager
   kg_resource.py01185%33–34, 36–37, 65–66, 81–82, 87–89
services/logger_services
   __init__.py00100% 
   log_functions.py00100% 
services/output_manager
   __init__.py00100% 
   error_handler.py0198%104
   help_page.py01484%27–28, 36–37, 46–47, 59–60, 106–107, 116–117, 129–130
   message_handler.py06558%17–22, 27, 32, 37, 47, 52–54, 59, 64, 69, 74, 87, 92, 99, 104, 109, 113, 129, 144, 154, 164, 183, 187, 191, 205–216, 227–232, 234–240, 251, 255–256, 260–261, 263–264, 268, 272, 276
   response_handler.py0530%5–6, 9–12, 14–15, 17–21, 23–24, 26–34, 36–39, 42–45, 47–48, 50–56, 58–59, 61–63, 65–68, 71–73
services/project_manager
   __init__.py00100% 
   project.py0683%38, 44–45, 47–49
services/user_authentication
   __init__.py00100% 
   decorator.py01367%29, 32, 49–53, 55, 59–62, 64
   token_manager.py02157%25, 28–30, 33, 36–37, 40–41, 61, 65, 69–70, 76–77, 79–82, 84–85
   user_login_logout.py04365%40–43, 114, 118–124, 126–128, 132–133, 137–144, 146–148, 152–153, 160–165, 167–169, 173–176
   user_set_config.py0947%15–18, 22–24, 26–27
utils
   __init__.py00100% 
   aggregated.py04155%22, 46, 62–73, 75–77, 83–84, 86, 90–93, 95–96, 115–117, 119, 124–131, 133–135
TOTAL2969155347% 

@colorzzr
colorzzr merged commit a761b9f into hdc Sep 6, 2023
@colorzzr
colorzzr deleted the IHDC-346 branch March 4, 2024 21:33
colorzzr added a commit that referenced this pull request May 1, 2024
* update the config creation logic to avoid the injection

* bumpup version

---------

Co-authored-by: zhiren <zzhan@indocresearch.org>
colorzzr added a commit that referenced this pull request May 1, 2024
* update the config creation logic to avoid the injection

* bumpup version

---------

Co-authored-by: zhiren <zzhan@indocresearch.org>
Former-commit-id: b8c1e28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants