From 5e321936a8dc5e76ae7c7ce45bf264624da618f0 Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Mon, 29 Jan 2024 04:44:26 +0000 Subject: [PATCH 1/7] [Python] - Fix for security vulnerability GHSA-r9hx-vwmv-q579 for setuptools-65.5.0 lib on python using python image --- src/python/install.sh | 14 ++++ ...tall_python310_setuptools_vulnerability.sh | 68 +++++++++++++++++++ ...tall_python311_setuptools_vulnerability.sh | 68 +++++++++++++++++++ test/python/scenarios.json | 18 +++++ 4 files changed, 168 insertions(+) create mode 100644 test/python/install_python310_setuptools_vulnerability.sh create mode 100644 test/python/install_python311_setuptools_vulnerability.sh diff --git a/src/python/install.sh b/src/python/install.sh index e6eefd055..c865d531a 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -454,6 +454,20 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; echo "${util} already installed. Skipping." fi done + + # Temporary: Removes “setup tools” metadata directory due to https://github.com/advisories/GHSA-r9hx-vwmv-q579 + + VULNERABLE_VERSIONS=("3.10" "3.11") + RUN_TIME_PY_VER_DETECT=$(python --version 2>&1) + PY_MAJOR_MINOR_VER=${RUN_TIME_PY_VER_DETECT:7:4}; + + for vv in "${VULNERABLE_VERSIONS[@]}"; do + if [ "${PY_MAJOR_MINOR_VER}" == "${vv}" ]; then + rm -rf ${PIPX_HOME}/shared/lib/"python${vv}"/site-packages/setuptools-65.5.0.dist-info + rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info + fi + done + rm -rf /tmp/pip-tmp updaterc "export PIPX_HOME=\"${PIPX_HOME}\"" diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/scenarios.json b/test/python/scenarios.json index 23b6cfc92..493f99f1f 100644 --- a/test/python/scenarios.json +++ b/test/python/scenarios.json @@ -1,4 +1,22 @@ { + "install_python310_setuptools_vulnerability": { + "image": "python:3.10", + "features": { + "python": { + "version": "none", + "installTools": true + } + } + }, + "install_python311_setuptools_vulnerability": { + "image": "python:3.11", + "features": { + "python": { + "version": "none", + "installTools": true + } + } + }, "install_additional_python": { "image": "ubuntu:focal", "features": { From 236d0b336c0d9ef20ffee8f45b182c3c000d1bb8 Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Mon, 29 Jan 2024 11:21:23 +0000 Subject: [PATCH 2/7] [Python] - Added one more test --- test/python/install_python310_setuptools_vulnerability.sh | 6 ++++-- test/python/install_python311_setuptools_vulnerability.sh | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh index cbc3ad090..aecd2db05 100644 --- a/test/python/install_python310_setuptools_vulnerability.sh +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -22,8 +22,8 @@ check "pytest" pytest --version check "setuptools" pip list | grep setuptools # Check paths in settings -check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -check "current symlink works" /usr/local/python/current/bin/python --version +# check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +# check "current symlink works" /usr/local/python/current/bin/python --version check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" @@ -57,6 +57,8 @@ checkVulnerableDir() fi } +check "find test" bash -c "find . -name '*setuptools*'" + # only for 3.10 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh index cbc3ad090..aecd2db05 100644 --- a/test/python/install_python311_setuptools_vulnerability.sh +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -22,8 +22,8 @@ check "pytest" pytest --version check "setuptools" pip list | grep setuptools # Check paths in settings -check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -check "current symlink works" /usr/local/python/current/bin/python --version +# check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +# check "current symlink works" /usr/local/python/current/bin/python --version check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" @@ -57,6 +57,8 @@ checkVulnerableDir() fi } +check "find test" bash -c "find . -name '*setuptools*'" + # only for 3.10 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" From cfd57c1f1ecc1006e6acd32195b76c0f3b772b76 Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Mon, 29 Jan 2024 04:44:26 +0000 Subject: [PATCH 3/7] [Python] - Fix for security vulnerability GHSA-r9hx-vwmv-q579 for setuptools-65.5.0 lib on python using python image --- src/python/install.sh | 14 ++++ ...tall_python310_setuptools_vulnerability.sh | 68 +++++++++++++++++++ ...tall_python311_setuptools_vulnerability.sh | 68 +++++++++++++++++++ test/python/scenarios.json | 18 +++++ 4 files changed, 168 insertions(+) create mode 100644 test/python/install_python310_setuptools_vulnerability.sh create mode 100644 test/python/install_python311_setuptools_vulnerability.sh diff --git a/src/python/install.sh b/src/python/install.sh index e6eefd055..c865d531a 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -454,6 +454,20 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; echo "${util} already installed. Skipping." fi done + + # Temporary: Removes “setup tools” metadata directory due to https://github.com/advisories/GHSA-r9hx-vwmv-q579 + + VULNERABLE_VERSIONS=("3.10" "3.11") + RUN_TIME_PY_VER_DETECT=$(python --version 2>&1) + PY_MAJOR_MINOR_VER=${RUN_TIME_PY_VER_DETECT:7:4}; + + for vv in "${VULNERABLE_VERSIONS[@]}"; do + if [ "${PY_MAJOR_MINOR_VER}" == "${vv}" ]; then + rm -rf ${PIPX_HOME}/shared/lib/"python${vv}"/site-packages/setuptools-65.5.0.dist-info + rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info + fi + done + rm -rf /tmp/pip-tmp updaterc "export PIPX_HOME=\"${PIPX_HOME}\"" diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh new file mode 100644 index 000000000..cbc3ad090 --- /dev/null +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" +#checkPythonPackageVersion "setuptools" "65.5.1" + +# Check that tools can execute - make sure something didn't get messed up in this scenario +check "autopep8" autopep8 --version +check "black" black --version +check "yapf" yapf --version +check "bandit" bandit --version +check "flake8" flake8 --version +check "mypy" mypy --version +check "pycodestyle" pycodestyle --version +check "pydocstyle" pydocstyle --version +check "pylint" pylint --version +check "pytest" pytest --version +check "setuptools" pip list | grep setuptools + +# Check paths in settings +check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +check "current symlink works" /usr/local/python/current/bin/python --version +check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" +check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" +check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" +check "which bandit" bash -c "which bandit | grep /usr/local/py-utils/bin/bandit" +check "which flake8" bash -c "which flake8 | grep /usr/local/py-utils/bin/flake8" +check "which mypy" bash -c "which mypy | grep /usr/local/py-utils/bin/mypy" +check "which pycodestyle" bash -c "which pycodestyle | grep /usr/local/py-utils/bin/pycodestyle" +check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bin/pydocstyle" +check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" +check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" + +echoStderr() +{ + echo "$@" 1>&2 +} + +checkVulnerableDir() +{ + DIRECTORY=$1 + VERSION=$2 + + if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.10." + return 1 + elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then + echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + return 1 + else + echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." + return 0 + fi +} + +# only for 3.10 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" +# only for 3.11 +checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" +checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" + +# Report result +reportResults diff --git a/test/python/scenarios.json b/test/python/scenarios.json index 23b6cfc92..493f99f1f 100644 --- a/test/python/scenarios.json +++ b/test/python/scenarios.json @@ -1,4 +1,22 @@ { + "install_python310_setuptools_vulnerability": { + "image": "python:3.10", + "features": { + "python": { + "version": "none", + "installTools": true + } + } + }, + "install_python311_setuptools_vulnerability": { + "image": "python:3.11", + "features": { + "python": { + "version": "none", + "installTools": true + } + } + }, "install_additional_python": { "image": "ubuntu:focal", "features": { From 725ef47e7339fc0ff80e02d290bbc3770a04eb7b Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Mon, 29 Jan 2024 11:21:23 +0000 Subject: [PATCH 4/7] [Python] - Added one more test --- test/python/install_python310_setuptools_vulnerability.sh | 6 ++++-- test/python/install_python311_setuptools_vulnerability.sh | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh index cbc3ad090..aecd2db05 100644 --- a/test/python/install_python310_setuptools_vulnerability.sh +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -22,8 +22,8 @@ check "pytest" pytest --version check "setuptools" pip list | grep setuptools # Check paths in settings -check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -check "current symlink works" /usr/local/python/current/bin/python --version +# check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +# check "current symlink works" /usr/local/python/current/bin/python --version check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" @@ -57,6 +57,8 @@ checkVulnerableDir() fi } +check "find test" bash -c "find . -name '*setuptools*'" + # only for 3.10 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh index cbc3ad090..aecd2db05 100644 --- a/test/python/install_python311_setuptools_vulnerability.sh +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -22,8 +22,8 @@ check "pytest" pytest --version check "setuptools" pip list | grep setuptools # Check paths in settings -check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -check "current symlink works" /usr/local/python/current/bin/python --version +# check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" +# check "current symlink works" /usr/local/python/current/bin/python --version check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" @@ -57,6 +57,8 @@ checkVulnerableDir() fi } +check "find test" bash -c "find . -name '*setuptools*'" + # only for 3.10 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" From 3fdde5ee8bedd67c0e4ab1e373bffa8e309a1d4b Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Tue, 30 Jan 2024 13:42:48 +0000 Subject: [PATCH 5/7] Changes as suggested by comments --- src/python/install.sh | 11 ++-- ...tall_python310_setuptools_vulnerability.sh | 58 +++++++++++++------ ...tall_python311_setuptools_vulnerability.sh | 57 ++++++++++++------ 3 files changed, 82 insertions(+), 44 deletions(-) diff --git a/src/python/install.sh b/src/python/install.sh index c865d531a..9da07ac56 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -460,13 +460,10 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; VULNERABLE_VERSIONS=("3.10" "3.11") RUN_TIME_PY_VER_DETECT=$(python --version 2>&1) PY_MAJOR_MINOR_VER=${RUN_TIME_PY_VER_DETECT:7:4}; - - for vv in "${VULNERABLE_VERSIONS[@]}"; do - if [ "${PY_MAJOR_MINOR_VER}" == "${vv}" ]; then - rm -rf ${PIPX_HOME}/shared/lib/"python${vv}"/site-packages/setuptools-65.5.0.dist-info - rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info - fi - done + if [[ ${VULNERABLE_VERSIONS[@]} =~ $PY_MAJOR_MINOR_VER ]]; then + rm -rf ${PIPX_HOME}/shared/lib/"python${PY_MAJOR_MINOR_VER}"/site-packages/setuptools-65.5.0.dist-info + rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${PY_MAJOR_MINOR_VER}/site-packages/setuptools-65.5.0.dist-info + fi rm -rf /tmp/pip-tmp diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh index aecd2db05..8cf2f9a8d 100644 --- a/test/python/install_python310_setuptools_vulnerability.sh +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -1,12 +1,43 @@ #!/bin/bash - set -e # Optional: Import test library source dev-container-features-test-lib -#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" -#checkPythonPackageVersion "setuptools" "65.5.1" +FAILED=() + +echoStderr() +{ + echo "$@" 1>&2 +} + +check-version-ge() { + LABEL=$1 + CURRENT_VERSION=$2 + REQUIRED_VERSION=$3 + shift + echo -e "\n🧪 Testing $LABEL: '$CURRENT_VERSION' is >= '$REQUIRED_VERSION'" + local GREATER_VERSION=$((echo ${CURRENT_VERSION}; echo ${REQUIRED_VERSION}) | sort -V | tail -1) + if [ "${CURRENT_VERSION}" == "${GREATER_VERSION}" ]; then + echo "✅ Passed!" + return 0 + else + echoStderr "❌ $LABEL check failed." + FAILED+=("$LABEL") + return 1 + fi +} + +checkPythonPackageVersion() +{ + PACKAGE=$1 + REQUIRED_VERSION=$2 + + current_version=$(python -c "import importlib.metadata; print(importlib.metadata.version('${PACKAGE}'))") + check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}" +} + +checkPythonPackageVersion "setuptools" "65.5.1" # Check that tools can execute - make sure something didn't get messed up in this scenario check "autopep8" autopep8 --version @@ -22,8 +53,6 @@ check "pytest" pytest --version check "setuptools" pip list | grep setuptools # Check paths in settings -# check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -# check "current symlink works" /usr/local/python/current/bin/python --version check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" @@ -35,21 +64,13 @@ check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bi check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" -echoStderr() -{ - echo "$@" 1>&2 -} - checkVulnerableDir() { DIRECTORY=$1 VERSION=$2 - if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then - echoStderr "❌ check for vulnerable setuptools version failed for python3.10." - return 1 - elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then - echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + if [[ -d $DIRECTORY ]] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python ${VERSION}." return 1 else echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." @@ -57,14 +78,13 @@ checkVulnerableDir() fi } -check "find test" bash -c "find . -name '*setuptools*'" +bash -c "echo -e -n '\n'"; +bash -c "echo -e 'Files/Folders related to setuptools :-'"; +bash -c "find / -name \"*setuptools*\";" # only for 3.10 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" -# only for 3.11 -checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" -checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" # Report result reportResults diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh index aecd2db05..77c503995 100644 --- a/test/python/install_python311_setuptools_vulnerability.sh +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -5,8 +5,40 @@ set -e # Optional: Import test library source dev-container-features-test-lib -#check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" -#checkPythonPackageVersion "setuptools" "65.5.1" +FAILED=() + +echoStderr() +{ + echo "$@" 1>&2 +} + +check-version-ge() { + LABEL=$1 + CURRENT_VERSION=$2 + REQUIRED_VERSION=$3 + shift + echo -e "\n🧪 Testing $LABEL: '$CURRENT_VERSION' is >= '$REQUIRED_VERSION'" + local GREATER_VERSION=$((echo ${CURRENT_VERSION}; echo ${REQUIRED_VERSION}) | sort -V | tail -1) + if [ "${CURRENT_VERSION}" == "${GREATER_VERSION}" ]; then + echo "✅ Passed!" + return 0 + else + echoStderr "❌ $LABEL check failed." + FAILED+=("$LABEL") + return 1 + fi +} + +checkPythonPackageVersion() +{ + PACKAGE=$1 + REQUIRED_VERSION=$2 + + current_version=$(python -c "import importlib.metadata; print(importlib.metadata.version('${PACKAGE}'))") + check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}" +} + +checkPythonPackageVersion "setuptools" "65.5.1" # Check that tools can execute - make sure something didn't get messed up in this scenario check "autopep8" autopep8 --version @@ -22,8 +54,6 @@ check "pytest" pytest --version check "setuptools" pip list | grep setuptools # Check paths in settings -# check "current symlink is correct" bash -c "which python | grep /usr/local/python/current/bin/python" -# check "current symlink works" /usr/local/python/current/bin/python --version check "which autopep8" bash -c "which autopep8 | grep /usr/local/py-utils/bin/autopep8" check "which black" bash -c "which black | grep /usr/local/py-utils/bin/black" check "which yapf" bash -c "which yapf | grep /usr/local/py-utils/bin/yapf" @@ -35,21 +65,13 @@ check "which pydocstyle" bash -c "which pydocstyle | grep /usr/local/py-utils/bi check "which pylint" bash -c "which pylint | grep /usr/local/py-utils/bin/pylint" check "which pytest" bash -c "which pytest | grep /usr/local/py-utils/bin/pytest" -echoStderr() -{ - echo "$@" 1>&2 -} - checkVulnerableDir() { DIRECTORY=$1 VERSION=$2 - if [ "${VERSION}" == "3.10" ] && [ -d $DIRECTORY ] ; then - echoStderr "❌ check for vulnerable setuptools version failed for python3.10." - return 1 - elif [ "${VERSION}" == "3.11" ] && [ -d $DIRECTORY ]; then - echoStderr "❌ check for vulnerable setuptools version failed for python3.11." + if [[ -d $DIRECTORY ]] ; then + echoStderr "❌ check for vulnerable setuptools version failed for python ${VERSION}." return 1 else echo "✅ Passed! Either the container does not have vulnerable version or vulnerable version specific directory got removed." @@ -57,11 +79,10 @@ checkVulnerableDir() fi } -check "find test" bash -c "find . -name '*setuptools*'" +bash -c "echo -e -n '\n'"; +bash -c "echo -e 'Files/Folders related to setuptools :-'"; +bash -c "find / -name \"*setuptools*\";" -# only for 3.10 -checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" -checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" # only for 3.11 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" From aee4d8ae950209eb4aeacc4d7f8781c3bacf4dd7 Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Thu, 1 Feb 2024 19:44:26 +0000 Subject: [PATCH 6/7] removed second line (L465) that removed a non existent dirrectory --- src/python/install.sh | 1 - test/python/install_python310_setuptools_vulnerability.sh | 1 - test/python/install_python311_setuptools_vulnerability.sh | 1 - 3 files changed, 3 deletions(-) diff --git a/src/python/install.sh b/src/python/install.sh index 9da07ac56..aff1327b2 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -462,7 +462,6 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; PY_MAJOR_MINOR_VER=${RUN_TIME_PY_VER_DETECT:7:4}; if [[ ${VULNERABLE_VERSIONS[@]} =~ $PY_MAJOR_MINOR_VER ]]; then rm -rf ${PIPX_HOME}/shared/lib/"python${PY_MAJOR_MINOR_VER}"/site-packages/setuptools-65.5.0.dist-info - rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${PY_MAJOR_MINOR_VER}/site-packages/setuptools-65.5.0.dist-info fi rm -rf /tmp/pip-tmp diff --git a/test/python/install_python310_setuptools_vulnerability.sh b/test/python/install_python310_setuptools_vulnerability.sh index 8cf2f9a8d..d6f68f1fb 100644 --- a/test/python/install_python310_setuptools_vulnerability.sh +++ b/test/python/install_python310_setuptools_vulnerability.sh @@ -84,7 +84,6 @@ bash -c "find / -name \"*setuptools*\";" # only for 3.10 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" -checkVulnerableDir "/usr/local/python/3.10.13/lib/python3.10/site-packages/setuptools-65.5.0.dist-info" "3.10" # Report result reportResults diff --git a/test/python/install_python311_setuptools_vulnerability.sh b/test/python/install_python311_setuptools_vulnerability.sh index 77c503995..b1e3983d2 100644 --- a/test/python/install_python311_setuptools_vulnerability.sh +++ b/test/python/install_python311_setuptools_vulnerability.sh @@ -85,7 +85,6 @@ bash -c "find / -name \"*setuptools*\";" # only for 3.11 checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" -checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" # Report result reportResults From 43d9cf4c1f808d84b64077099018968670af8ee9 Mon Sep 17 00:00:00 2001 From: gaurav saini Date: Fri, 2 Feb 2024 00:35:32 +0000 Subject: [PATCH 7/7] bump patch version & change code to pass failing tests --- src/python/devcontainer-feature.json | 2 +- src/python/install.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/python/devcontainer-feature.json b/src/python/devcontainer-feature.json index 7ebdad38a..46f19b6ab 100644 --- a/src/python/devcontainer-feature.json +++ b/src/python/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "python", - "version": "1.3.1", + "version": "1.3.2", "name": "Python", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/python", "description": "Installs the provided version of Python, as well as PIPX, and other common Python utilities. JupyterLab is conditionally installed with the python feature. Note: May require source code compilation.", diff --git a/src/python/install.sh b/src/python/install.sh index aff1327b2..799f1ed8a 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -460,7 +460,7 @@ if [[ "${INSTALL_PYTHON_TOOLS}" = "true" ]] && [[ $(python --version) != "" ]]; VULNERABLE_VERSIONS=("3.10" "3.11") RUN_TIME_PY_VER_DETECT=$(python --version 2>&1) PY_MAJOR_MINOR_VER=${RUN_TIME_PY_VER_DETECT:7:4}; - if [[ ${VULNERABLE_VERSIONS[@]} =~ $PY_MAJOR_MINOR_VER ]]; then + if [[ ${VULNERABLE_VERSIONS[*]} =~ $PY_MAJOR_MINOR_VER ]]; then rm -rf ${PIPX_HOME}/shared/lib/"python${PY_MAJOR_MINOR_VER}"/site-packages/setuptools-65.5.0.dist-info fi