From e8172d4c765345589c9fb59614b046cdc44a7ebe Mon Sep 17 00:00:00 2001 From: bhupendra-vaishnav <148317470+bhupendra-vaishnav@users.noreply.github.com> Date: Fri, 26 Jan 2024 20:56:42 +0000 Subject: [PATCH 1/3] Planned fix for security vulnerability for package setuptools-65.5.0 https://github.com/advisories/GHSA-r9hx-vwmv-q579 Added or modified files are : src/python/install.sh test/python/install_python_setuptools_vulnerability.sh test/python/scenarios.json --- src/python/install.sh | 13 ++++ ...install_python_setuptools_vulnerability.sh | 68 +++++++++++++++++++ test/python/scenarios.json | 9 +++ 3 files changed, 90 insertions(+) create mode 100644 test/python/install_python_setuptools_vulnerability.sh diff --git a/src/python/install.sh b/src/python/install.sh index e6eefd055..4e72a722e 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -454,6 +454,19 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; echo "${util} already installed. Skipping." fi done + + # Temporary: Removes “setup tools” metadata directory due to https://github.com/advisories/GHSA-r9hx-vwmv-q579 + + VULNERABLE_VERSIONS=("3.10" "3.11") + + for vv in "${VULNERABLE_VERSIONS[@]}"; do + + if [ "${PYTHON_VERSION}" == "${vv}" ]; then + rm -rf ${PIPX_HOME}/shared/lib/"python${vv}"/site-packages/setuptools-65.5.0.dist-info + #rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info + fi + done + rm -rf /tmp/pip-tmp updaterc "export PIPX_HOME=\"${PIPX_HOME}\"" diff --git a/test/python/install_python_setuptools_vulnerability.sh b/test/python/install_python_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/scenarios.json b/test/python/scenarios.json index 23b6cfc92..3dbc5080c 100644 --- a/test/python/scenarios.json +++ b/test/python/scenarios.json @@ -1,4 +1,13 @@ { + "install_python_setuptools_vulnerability": { + "image": "debian:bookworm", + "features": { + "python": { + "version": "3.10", + "installTools": true + } + } + }, "install_additional_python": { "image": "ubuntu:focal", "features": { From 45b8ae9a1a6c77da94fb0567fc3fa4fb9854667b Mon Sep 17 00:00:00 2001 From: bhupendra-vaishnav <148317470+bhupendra-vaishnav@users.noreply.github.com> Date: Sat, 27 Jan 2024 01:56:05 +0000 Subject: [PATCH 2/3] Planned fix for security vulnerability GHSA-r9hx-vwmv-q579 for setuptools-65.5.0 lib Modifed as per the review comments give by Samrudhdhi. Added or modified files are : modified: src/python/install.sh new file: test/python/install_python310_setuptools_vulnerability.sh new file: test/python/install_python311_setuptools_vulnerability.sh modified: test/python/scenarios.json --- src/python/install.sh | 7 +- ...tall_python310_setuptools_vulnerability.sh | 68 +++++++++++++++++++ ...tall_python311_setuptools_vulnerability.sh | 68 +++++++++++++++++++ test/python/scenarios.json | 13 +++- 4 files changed, 151 insertions(+), 5 deletions(-) create mode 100644 test/python/install_python310_setuptools_vulnerability.sh create mode 100644 test/python/install_python311_setuptools_vulnerability.sh diff --git a/src/python/install.sh b/src/python/install.sh index 4e72a722e..c865d531a 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -458,12 +458,13 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; # Temporary: Removes “setup tools” metadata directory due to https://github.com/advisories/GHSA-r9hx-vwmv-q579 VULNERABLE_VERSIONS=("3.10" "3.11") + RUN_TIME_PY_VER_DETECT=$(python --version 2>&1) + PY_MAJOR_MINOR_VER=${RUN_TIME_PY_VER_DETECT:7:4}; for vv in "${VULNERABLE_VERSIONS[@]}"; do - - if [ "${PYTHON_VERSION}" == "${vv}" ]; then + if [ "${PY_MAJOR_MINOR_VER}" == "${vv}" ]; then rm -rf ${PIPX_HOME}/shared/lib/"python${vv}"/site-packages/setuptools-65.5.0.dist-info - #rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info + rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info fi done diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/scenarios.json b/test/python/scenarios.json index 3dbc5080c..4de433157 100644 --- a/test/python/scenarios.json +++ b/test/python/scenarios.json @@ -1,6 +1,6 @@ { - "install_python_setuptools_vulnerability": { - "image": "debian:bookworm", + "install_python310_setuptools_vulnerability": { + "image": "python:3.10", "features": { "python": { "version": "3.10", @@ -8,6 +8,15 @@ } } }, + "install_python311_setuptools_vulnerability": { + "image": "python:3.11", + "features": { + "python": { + "version": "3.11", + "installTools": true + } + } + }, "install_additional_python": { "image": "ubuntu:focal", "features": { From 068eaa280971d027d81891927acc3a25f98d7c60 Mon Sep 17 00:00:00 2001 From: bhupendra-vaishnav <148317470+bhupendra-vaishnav@users.noreply.github.com> Date: Fri, 26 Jan 2024 19:44:37 -0700 Subject: [PATCH 3/3] Delete test/python/install_python_setuptools_vulnerability.sh unwanted file --- ...install_python_setuptools_vulnerability.sh | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 test/python/install_python_setuptools_vulnerability.sh diff --git a/test/python/install_python_setuptools_vulnerability.sh b/test/python/install_python_setuptools_vulnerability.sh deleted file mode 100644 index cbc3ad090..000000000 --- a/test/python/install_python_setuptools_vulnerability.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash - -set -e - -# Optional: Import test library -source dev-container-features-test-lib - -#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" -#checkPythonPackageVersion "setuptools" "65.5.1" - -# Check that tools can execute - make sure something didn't get messed up in this scenario -check "autopep8" autopep8 --version -check "black" black --version -check "yapf" yapf --version -check "bandit" bandit --version -check "flake8" flake8 --version -check "mypy" mypy --version -check "pycodestyle" pycodestyle --version -check "pydocstyle" pydocstyle --version -check "pylint" pylint --version -check "pytest" pytest --version -check "setuptools" pip list | grep setuptools - -# Check paths in settings -check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -check "current symlink works" /usr/local/python/current/bin/python --version -check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" -check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" -check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" -check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" -check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" -check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" -check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" -check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" -check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" -check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" - -echoStderr() -{ - echo "$@" 1>&2 -} - -checkVulnerableDir() -{ - DIRECTORY=$1 - VERSION=$2 - - if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then - echoStderr "❌ check for vulnerable setuptools version failed for python3.10." - return 1 - elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then - echoStderr "❌ check for vulnerable setuptools version failed for python3.11." - return 1 - else - echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." - return 0 - fi -} - -# only for 3.10 -checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" -checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" -# only for 3.11 -checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" -checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" - -# Report result -reportResults