Repository navigation
[5.0] Misc fix backport - #809
Merged
Merged
Conversation
Replace Subprocess.shellCall with Subprocess.systemCall using argument lists instead of shell-interpolated strings. This prevents potential command injection if file paths or passwords contain shell metacharacters. Also changed -password to -passin/-passout which are the correct OpenSSL flags (the old flags worked but were deprecated/ambiguous).
The web_hostAction and web_componentAction methods allow restarting DIRAC components, reverting software, and updating software on any host. These are destructive operations that should require elevated privileges. Add @authorization decorator requiring CSAdministrator or ServiceAdministrator property for these methods instead of allowing any authenticated user.
The root.tpl template has autoescape disabled ({% autoescape None %}),
so the welcome file content is rendered as raw HTML. If an attacker can
modify the welcome file, they could inject malicious scripts.
Fix:
- Use bleach.clean() to sanitize HTML, allowing only safe tags (p, br, a,
img, headings, lists, emphasis) and limited attributes
- Fall back to xhtml_escape if bleach is not available
- Use tempfile.mkdtemp() instead of predictable time.time()+random() for secure temporary directory creation - Validate archivePath in second pass to ensure it's within the system temp directory, preventing path traversal attacks like reading /etc/passwd - Use os.path.realpath() to resolve symlinks before validation - Add error handling for file cleanup operations
- Use json_encode() for JavaScript context escaping instead of raw template interpolation which allowed XSS via access_token and next params - Add __validateNextURL() to prevent open redirect attacks by rejecting URLs with dangerous schemes (javascript:, data:) or external hosts - Add samesite="Lax" to all cookies to mitigate CSRF attacks
…ification Using jwt.decode with verify_signature=False is a dangerous pattern that can be accidentally copied to security-critical code. Replace with jwt.get_unverified_claims() which explicitly indicates the intent to read token payload for display purposes only without verification. The tokens come from the trusted TokenManagerClient backend and are only displayed to the user, not used for authorization decisions.
… catalog download
- Use jwt.decode with verify_signature=False: jwt.get_unverified_claims does not exist in PyJWT (caught by pylint E1101) - Rename Properties.CSAdministrator/ServiceAdministrator to Properties.CS_ADMINISTRATOR/SERVICE_ADMINISTRATOR, as fixed upstream in DIRACGrid#807 (caught by pylint E1101 against DIRAC rel-v8r0) - Apply black/prettier formatting to satisfy pre-commit
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a backport of #808 + various other minor fixes that have been applied recently on 6.0; all the same sort of stuff.
Regards,
Simon
BEGINRELEASENOTES
FIX: Collection of minor webapp fixes
ENDRELEASENOTES