Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resolve Dependabot Alerts #1891

Open
wants to merge 1 commit into
base: xdmod11.0
Choose a base branch
from
Open

Resolve Dependabot Alerts #1891

wants to merge 1 commit into from

Conversation

ryanrath
Copy link
Contributor

@ryanrath ryanrath commented Aug 1, 2024 •
edited
Loading

Note: The upgrade won't pass because the patch files have lines that have trailing whitespace in them. But if the whitespace is removed the patches no longer work soooo... yeah, that's a thing.

Description

  • .circleci/config.yml:
    • Updated the pecl install for mongodb to specifically install version 1.19.3, which is the current version, as we've been bitten more than once by not explicitly specifying which version we want. A point of discussion for this could be do we want to install the latest dependencies? If so, where do we want to install these dependencies? i.e. in the CI build? In the production build? etc.
  • BaseControllerProvider.php: the namespace for the ControllerProviderInterface; interface changed in the latest version of Silex ( from Silex\ControllerProviderInterface to Silex\Api\ControllerProviderInterface).
  • XdmodApplicationFactory.php:
    • UrlGeneratorServiceProvider has been changed to RoutingServiceProvider.
    • there is no more app->share function, you just use an anonymous function.
    • the Request $request argument has been added to the anonymous function called by the $app->error helper
      function.
  • composer.json:
  • open_xdmod/modules/xdmod/assets/setup.sh:
    • Removed the Composer Install section as this + the dangling cd was causing the composer dependencies of qa to be installed in the xdmod directory. This probably wasn't a problem or caught before because we were not previously patching files.
    • Changed the cd $xdmod_dirto a pushd | popd so that we reset the cwd after the script runs.
  • open_xdmod/modules/xdmod/build.json
  • tests/ci/scripts/qa-test-setup.sh:
    • Taking care of the other part of the Case of the Mysterious Disappearing Dependencies. Just made sure to save the existing $COMPOSER env variable so that we can restore it after we're done installing the qa dependencies.

SimpleSAMLphp Patches

Motivation and Context

We have a number of Dependabot Alerts that should probably be resolved. The following changes should do that for the symfony/* and simplesamlphp/simplesamlphp dependencies.

Tests performed

All automated tests pass.

Checklist:

  • The pull request description is suitable for a Changelog entry
  • The milestone is set correctly on the pull request
  • The appropriate labels have been added to the pull request

@ryanrath ryanrath force-pushed the update-silex branch 2 times, most recently from f907912 to 12d8c71 Compare August 6, 2024 01:38
@ryanrath ryanrath added Category:General General security Relating to some aspect of security for XDMoD labels Aug 6, 2024
@ryanrath ryanrath added this to the 11.5.0 milestone Aug 6, 2024
@ryanrath ryanrath changed the title Upate Silex Resolve Dependabot Alerts Aug 6, 2024
@ryanrath
Updating Silex to the latest version 2.3.0
e2536f1 
- There are a number of outstanding Dependabot alerts on our symfony/*
dependencies from our current version of Silex. This update resolves
all of them.

- There are three outstanding SimpleSAMLPHP CVEs that we are unable to
address via simply upgrading to a fixed version. Therefor to remediate
these threats I've included patches that will be applied in the
pre-build step of RPM generation ( `open_xdmod/modules/xdmod/build.json`
). Below is a list of the CVE's, the corresponding fix in
SimpleSAMLPHP's github repo, the patch file to resolve the CVE and any
notes.
  - CVE-2020-5301: Information disclosure of source code in
    SimpleSAMLphp.
    - GitHub: simplesamlphp/simplesamlphp@47968d2
    - `open_xdmod/modules/xdmod/assets/simplesamlphp-CVE-2020-5031.diff`
    - Notes: The file that is patched in the original commit does not
      exist in our version of the library so I identified the equivalent
      file in our library, `www/errorreport.php`, and updated that
      instead.
  - CVE-2020-5225: Log injection in SimpleSAMLphp
    - Github: simplesamlphp/simplesamlphp@4623851
    - `open_xdmod/modules/xdmod/assets/simplesamlphp-CVE-2020-5225.diff`

- `open_xdmod/modules/xdmod/assets/setup.sh`
  - removing lines that are either no longer accurate ( echo ) or commented
    out ( composer install )
- `open_xdmod/modules/xdmod/build.json`
  - Since the build process happens twice during a CI build, once during the
    initial build and again during the qa tests for the build test, and we are
    patching files in vendor/simplesamlphp/simplesamlphp we need to make sure
    that we start fresh for each build.
- `tests/ci/qa-test-setup.sh`
  - Added some code to capture the `COMPOSER` env variable before changing it so
    that we can reset it to the original value after the qa setup process is
    done.
ryanrath added a commit to ryanrath/xdmod that referenced this pull request Aug 6, 2024
@ryanrath
Providing patch for CVE-2019-10913
9752931 
This patch sets up the patch pipeline in `build.json` and updates a few files
that will cause issues during the CI / QA tests / build process. These changes
originated in ubccr#1891 ( which will be merged in
11.5 ).
@ryanrath ryanrath mentioned this pull request Aug 6, 2024
Merged
3 tasks
ryanrath added a commit to ryanrath/xdmod that referenced this pull request Aug 7, 2024
@ryanrath
Providing patch for CVE-2019-10913
3ead1da 
This patch sets up the patch pipeline in `build.json` and updates a few files
that will cause issues during the CI / QA tests / build process. These changes
originated in ubccr#1891 ( which will be merged in
11.5 ).
ryanrath added a commit that referenced this pull request Aug 8, 2024
@ryanrath
Patch for symfony/http-foundation: CVE-2019-10913 (#1893)
41a7f80 
* Providing patch for CVE-2019-10913

This patch sets up the patch pipeline in `build.json` and updates a few files
that will cause issues during the CI / QA tests / build process. These changes
originated in #1891 ( which will be merged in
11.5 ).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jpwhite4 jpwhite4 Awaiting requested review from jpwhite4

@aaronweeden aaronweeden Awaiting requested review from aaronweeden

@connersaeli connersaeli Awaiting requested review from connersaeli

@aestoltm aestoltm Awaiting requested review from aestoltm

@eiffel777 eiffel777 Awaiting requested review from eiffel777

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
Category:General General security Relating to some aspect of security for XDMoD
Projects
None yet
Milestone
11.5.0
Development

Successfully merging this pull request may close these issues.
1 participant
@ryanrath