Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Use recommended way to create temporary files #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 13, 2021
Merged

Use recommended way to create temporary files #256

merged 2 commits into from
Oct 13, 2021

Conversation

@marcjansen
Copy link
Member

The function mktemp has been deprecated since Python 2.3 and the replacement NamedTemporaryFile should be used to ensure that no other process accidentially writes to the file we expect to be unique for us.

This addresses a common weakness "CWE-377: Insecure Temporary File" see e.g. https://cwe.mitre.org/data/definitions/377.html for more information.

This is not ready for review yet, as there are multiple instances where we use mktemp. Once I see how the build reacts to this, the others will follow.

@marcjansen marcjansen force-pushed the cwe-377-tempfile branch 6 times, most recently from 8701af5 to f0e6522 Compare October 10, 2021 13:59
anikaweinmann
anikaweinmann reviewed Oct 11, 2021
View reviewed changes
anikaweinmann
anikaweinmann reviewed Oct 13, 2021
View reviewed changes
@anikaweinmann
Copy link
Member

@marcjansen I change some things and now the tests are working.
The problem was, that the overwrite was not correct in the PC: ERROR: r.colors.out: Sorry, <overwrite> is not a valid parameter. Actinia sets in GRASS GIS the overwrite by default auf True, so that you can not unset it in a process chain: https://github.com/mundialis/actinia_core/blob/main/src/actinia_core/core/grass_init.py#L209

@marcjansen
Copy link
Member Author

Awesome!

griembauer
griembauer approved these changes Oct 13, 2021
View reviewed changes
Copy link
Contributor

@griembauer griembauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Just one small question, otherwise free to merge from my side

src/actinia_core/rest/raster_colors.py Outdated

pc["1"]["inputs"]["rules"] = rules_file
atexit.register(remove_rules_file, rules_file)
# TODO should we use dir=self.temp_file_path
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this comment be removed as self.temp_file_path is set or is this a question whether or not it makes sense to use it?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it makes sense to use it and will remove the comment

Copy link
Member Author

@marcjansen marcjansen Oct 13, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can also take over, in case you want me to

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@marcjansen yes you can do it yourself

@marcjansen
Use recommended way to create temporary files
bafb97d 
The function `mktemp` has been deprecated since Python 2.3 and the
replacement `NamedTemporaryFile` should be used to ensure that no other
process accidentially writes to the file we expect to be unique for us.

This addresses a common weakness "CWE-377: Insecure Temporary File" see
e.g. https://cwe.mitre.org/data/definitions/377.html for more
information.
@marcjansen marcjansen marked this pull request as ready for review October 13, 2021 12:01
@marcjansen
Copy link
Member Author

Thanks for the great help @anikaweinmann, much appreciated! Also thanks for the review, @griembauer and @anikaweinmann. I'll merge now.

@marcjansen marcjansen merged commit 0fb9c29 into actinia-org:main Oct 13, 2021
@marcjansen marcjansen deleted the cwe-377-tempfile branch October 13, 2021 12:02
@mmacata mmacata added this to the 2.0.0 milestone Nov 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anikaweinmann anikaweinmann anikaweinmann approved these changes

@griembauer griembauer griembauer approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

2.0.0

Development

Successfully merging this pull request may close these issues.

4 participants

@marcjansen @anikaweinmann @griembauer @mmacata