security: disallow uuid package on jinja2 #10794
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
villebro
changed the title
Co-authored-by: Ville Brofeldt <[email protected]>
Codecov Report
@@ Coverage Diff @@
## master #10794 +/- ##
==========================================
+ Coverage 61.22% 65.30% +4.07%
==========================================
Files 802 802
Lines 37814 37816 +2
Branches 3555 3555
==========================================
+ Hits 23153 24695 +1542
+ Misses 14475 13012 -1463
+ Partials 186 109 -77
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
villebro
added a commit
to preset-io/superset
that referenced
this pull request
Sep 4, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
villebro
added a commit
that referenced
this pull request
Sep 5, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
villebro
added a commit
that referenced
this pull request
Sep 5, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
amitmiran137
pushed a commit
to ofekisr/incubator-superset
that referenced
this pull request
Sep 7, 2020
…boards_permissions * upstream/master: (32 commits) docs: Add a note to contributing.md on reporting security vulnerabilities (apache#10796) Fix: Include RLS filters for cache keys (apache#10805) feat: filters for database list view (apache#10772) fix: MVC show saved query (apache#10781) added creator column and adjusted order columns (apache#10789) security: disallow uuid package on jinja2 (apache#10794) feat: CRUD REST API for saved queries (apache#10777) fix: disable domain sharding on explore view (apache#10787) fix: can not type `0.05` in `TextControl` (apache#10778) fix: pivot table timestamp grouping (apache#10774) fix: add validator information to email/slack alerts (apache#10762) More Label touchups (margins) (apache#10722) fix: dashboard extra filters (apache#10692) fix: re-installing local superset in cache image (apache#10766) feat: SIP-34 table list view for databases (apache#10705) refactor: convert DatasetList schema filter to use new distinct api (apache#10746) chore: removing fsevents dependency (apache#10751) Fix precommit hook for docs/installation.rst (apache#10759) feat(database): POST, PUT, DELETE API endpoints (apache#10741) docs: Update OAuth configuration in installation.rst (apache#10748) ...
dpgaspar
added a commit
to preset-io/superset
that referenced
this pull request
Sep 10, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
villebro
added a commit
to preset-io/superset
that referenced
this pull request
Sep 11, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
villebro
added a commit
that referenced
this pull request
Sep 11, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
auxten
pushed a commit
to auxten/incubator-superset
that referenced
this pull request
Nov 20, 2020
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
cccs-rc
pushed a commit
to CybercentreCanada/superset
that referenced
this pull request
Mar 6, 2024
* fix: disallow uuid package on jinja2 * update UPDATING.md * Update UPDATING.md Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]>
mistercrunch
added
🏷️ bot
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SUMMARY
Disallow the use of the entire
uuidpython package.There is a case to be made if we should disallow all packages completely. Checked all the other packages (used
dir(datetime)for example) and found nothing relevant.Safer to remove all packages and just allow "flat" functions, but this would result in a big loss of default functionality, for example on
datetime. User's can always reenable these usingJINJA_CONTEXT_ADDONSADDITIONAL INFORMATION