Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions errata/sources/repos/yum.py
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,8 @@ def add_updateinfo_erratum_references(e, update, ref_type, urls):
for url in urls:
e.add_reference(ref_type, url)
references = update.find('references')
if references is None:
return
for reference in references.findall('reference'):
if reference.attrib.get('type') == 'cve':
cve_id = reference.attrib.get('id')
Expand Down
4 changes: 2 additions & 2 deletions operatingsystems/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -269,7 +269,7 @@ def osvariant_bulk_action(request):

action = request.POST.get('action', '')
select_all_filtered = request.POST.get('select_all_filtered') == '1'
filter_params = request.POST.get('filter_params', '')
filter_params = sanitize_filter_params(request.POST.get('filter_params', ''))

if not action:
messages.warning(request, 'Please select an action')
Expand Down Expand Up @@ -310,7 +310,7 @@ def osrelease_bulk_action(request):

action = request.POST.get('action', '')
select_all_filtered = request.POST.get('select_all_filtered') == '1'
filter_params = request.POST.get('filter_params', '')
filter_params = sanitize_filter_params(request.POST.get('filter_params', ''))

if not action:
messages.warning(request, 'Please select an action')
Expand Down
7 changes: 4 additions & 3 deletions patchman/receivers.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,12 @@
# You should have received a copy of the GNU General Public License
# along with Patchman. If not, see <http://www.gnu.org/licenses/>

import sys

from colorama import Fore, Style, init
from django.conf import settings
from django.dispatch import receiver
from tqdm import tqdm
from tqdm.contrib.logging import logging_redirect_tqdm

from patchman.signals import (
Expand Down Expand Up @@ -54,9 +57,7 @@ def print_info_message(**kwargs):
"""
text = str(kwargs.get('text'))
if not get_quiet_mode():
with logging_redirect_tqdm(loggers=[logger]):
for line in text.splitlines():
logger.info(Style.RESET_ALL + Fore.RESET + line)
tqdm.write(text, file=sys.stdout)


@receiver(warning_message_s)
Expand Down
5 changes: 5 additions & 0 deletions patchman/sqlite3/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,11 @@


class DatabaseWrapper(base.DatabaseWrapper):
def get_new_connection(self, conn_params):
conn = super().get_new_connection(conn_params)
conn.execute('PRAGMA journal_mode=WAL')
return conn

def _start_transaction_under_autocommit(self):
# Acquire a write lock immediately for transactions
self.cursor().execute('BEGIN IMMEDIATE')
2 changes: 1 addition & 1 deletion reports/models.py
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ class Report(models.Model):
reboot = models.TextField(null=True, blank=True)

class Meta:
verbose_name_plural = 'Report'
verbose_name = 'Report'
verbose_name_plural = 'Reports'
ordering = ['-created']

Expand Down
2 changes: 1 addition & 1 deletion reports/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,7 @@ def report_bulk_action(request):

action = request.POST.get('action', '')
select_all_filtered = request.POST.get('select_all_filtered') == '1'
filter_params = request.POST.get('filter_params', '')
filter_params = sanitize_filter_params(request.POST.get('filter_params', ''))

if not action:
messages.warning(request, 'Please select an action')
Expand Down
1 change: 1 addition & 0 deletions repos/repo_types/yum.py
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ def extract_module_metadata(data, url, repo):
modules_yaml = yaml.safe_load_all(extracted)
except yaml.YAMLError as e:
error_message(text=f'Error parsing modules.yaml: {e}')
return modules

mlen = len(re.findall(r'---', yaml.dump(extracted.decode())))
pbar_start.send(sender=None, ptext=f'Extracting {mlen} Modules ', plen=mlen)
Expand Down
4 changes: 2 additions & 2 deletions repos/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -452,7 +452,7 @@ def repo_bulk_action(request):

action = request.POST.get('action', '')
select_all_filtered = request.POST.get('select_all_filtered') == '1'
filter_params = request.POST.get('filter_params', '')
filter_params = sanitize_filter_params(request.POST.get('filter_params', ''))

if not action:
messages.warning(request, 'Please select an action')
Expand Down Expand Up @@ -531,7 +531,7 @@ def mirror_bulk_action(request):

action = request.POST.get('action', '')
select_all_filtered = request.POST.get('select_all_filtered') == '1'
filter_params = request.POST.get('filter_params', '')
filter_params = sanitize_filter_params(request.POST.get('filter_params', ''))

if not action:
messages.warning(request, 'Please select an action')
Expand Down
4 changes: 3 additions & 1 deletion security/models.py
Original file line number Diff line number Diff line change
Expand Up @@ -179,8 +179,10 @@ def parse_osv_dev_cve_data(self, cve_json):
references = cve_json.get('references')
if references:
for reference in references:
ref_type = reference.get('type').capitalize()
url = reference.get('url')
if not url:
continue
ref_type = reference.get('type').capitalize()
get_or_create_reference(ref_type, url)
scores = cve_json.get('severity')
if scores:
Expand Down
12 changes: 8 additions & 4 deletions security/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -95,15 +95,19 @@
""" Fix up a Security Reference object to normalize the URL and type
"""
url = urlparse(ref.get('url'))
if not url.hostname:
return ref
ref_type = ref.get('ref_type')
if 'lists' in url.hostname or 'lists' in url.path:
hostname = url.hostname
if 'lists' in hostname or 'lists' in url.path:
ref_type = 'Mailing List'
if ref_type == 'bugzilla' or 'bug' in url.hostname or 'bugs' in url.path:
if ref_type == 'bugzilla' or 'bug' in hostname or 'bugs' in url.path:
ref_type = 'Bug Tracker'
url = fixup_ubuntu_usn_url(url)
if url.hostname == 'ubuntu.com' and url.path.startswith('/security/notices/USN'):
hostname = url.hostname
if hostname == 'ubuntu.com' and url.path.startswith('/security/notices/USN'):
ref_type = 'USN'
if 'launchpad.net' in url.hostname:
if 'launchpad.net' in hostname:

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High

The string
launchpad.net
may be at an arbitrary position in the sanitized URL.
Comment thread
furlongm marked this conversation as resolved.
Dismissed
ref_type = 'Bug Tracker'
netloc = url.netloc.replace('bugs.', '')
bug = url.path.split('/')[-1]
Expand Down
Loading