[device/juniper] Mitigation for security vulnerability by maipbui · Pull Request #11838 · sonic-net/sonic-buildimage

maipbui · 2022-08-24T18:01:33Z

Signed-off-by: maipbui maibui@microsoft.com

Dependency: #12065

Why I did it

commands module is not secure
command injection in getstatusoutput being used without a static string

How I did it

Eliminate commands module, use subprocess module only
Convert Python 2 to Python 3

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Signed-off-by: maipbui <maibui@microsoft.com>

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft · 2022-08-24T19:02:05Z

@ciju-juniper Could you help verify and review?

lgtm-com · 2022-08-24T19:16:32Z

This pull request introduces 1 alert when merging e783a42 into adffbd4 - view on LGTM.com

new alerts:

1 for Unused local variable

Signed-off-by: maipbui <maibui@microsoft.com>

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py

lgtm-com · 2022-08-31T22:06:04Z

This pull request introduces 3 alerts when merging f380aae into 6e878a3 - view on LGTM.com

new alerts:

2 for Unused local variable
1 for Unused import

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py

device/juniper/x86_64-juniper_qfx5210-r0/plugins/qfx5210_eeprom_data.py

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-09-01T05:01:14Z

This pull request introduces 1 alert when merging d40d086 into 88191b0 - view on LGTM.com

new alerts:

1 for Unused import

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui · 2022-09-12T19:50:06Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-09-12T19:50:19Z

Azure Pipelines successfully started running 1 pipeline(s).

maipbui · 2022-09-13T02:59:50Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-09-13T03:00:02Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-09-19T15:53:29Z

This pull request introduces 6 alerts when merging 9acf59c into c243af0 - view on LGTM.com

new alerts:

4 for Unused import
1 for First parameter of a method is not named 'self'
1 for Wrong number of arguments in a call

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft · 2022-09-19T22:57:46Z

platform/broadcom/sonic-platform-modules-juniper/qfx5210/utils/juniper_qfx5210_util.py

            show_set_help()
            return
-        #print  ALL_DEVICE['led']
+        #print( ALL_DEVICE['led']


(

This change does not make sense. Please revert. #Closed

qiluo-msft · 2022-09-19T22:58:07Z

platform/broadcom/sonic-platform-modules-juniper/qfx5210/utils/juniper_qfx5210_util.py

            return

-        #print  ALL_DEVICE[args[0]]   
+        #print( ALL_DEVICE[args[0]]   


(

Please revert. #Closed

qiluo-msft · 2022-09-19T22:59:39Z

platform/broadcom/sonic-platform-modules-juniper/qfx5210/utils/juniper_qfx5210_util.py

        print("============================================")

        for j in sorted(ALL_DEVICE[i].keys(), key=get_value):    
-            print "   "+j+":",


,

Original print without newline, the new code changes behavior. #Closed

Strictly speaking, you are using a blank as end, you should use empty string.

I think blank space should be used, ref: https://stackoverflow.com/a/18908914/19880750

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-10-05T16:52:38Z

This pull request introduces 1 alert when merging b53376c into 1f0699f - view on LGTM.com

new alerts:

1 for Comparison using is when operands support `__eq__`

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui · 2022-10-18T01:10:31Z

@ciju-juniper Could you help review and verify?

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-11-21T17:03:39Z

This pull request introduces 2 alerts when merging fb8b24f into 7b4032e - view on LGTM.com

new alerts:

1 for Unused import
1 for Syntax error

Heads-up: LGTM.com's PR analysis will be disabled on the 5th of December, and LGTM.com will be shut down ⏻ completely on the 16th of December 2022. Please enable GitHub code scanning, which uses the same CodeQL engine ⚙️ that powers LGTM.com. For more information, please check out our post on the GitHub blog.

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-11-21T17:37:45Z

This pull request introduces 1 alert when merging 2b45169 into 77b1be7 - view on LGTM.com

new alerts:

1 for Syntax error

Heads-up: LGTM.com's PR analysis will be disabled on the 5th of December, and LGTM.com will be shut down ⏻ completely on the 16th of December 2022. Please enable GitHub code scanning, which uses the same CodeQL engine ⚙️ that powers LGTM.com. For more information, please check out our post on the GitHub blog.

Signed-off-by: maipbui maibui@microsoft.com Dependency: [https://github.com/sonic-net/sonic-buildimage/pull/12065](https://github.com/sonic-net/sonic-buildimage/pull/12065) #### Why I did it `commands` module is not secure command injection in `getstatusoutput` being used without a static string #### How I did it Eliminate `commands` module, use `subprocess` module only Convert Python 2 to Python 3

Replace subprocess getstatusoutput by run

04d7d16

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui requested a review from qiluo-msft August 24, 2022 18:02

Fix var name

fba2445

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft reviewed Aug 24, 2022

View reviewed changes

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py Outdated Show resolved Hide resolved

qiluo-msft reviewed Aug 24, 2022

View reviewed changes

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py Outdated Show resolved Hide resolved

Add capture_output and minimize code change

e783a42

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui added 3 commits August 24, 2022 22:20

Remove unused variable

25af1be

Signed-off-by: maipbui <maibui@microsoft.com>

Add more args

954c0da

Signed-off-by: maipbui <maibui@microsoft.com>

Remove center directory

83d60d5

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft approved these changes Aug 31, 2022

View reviewed changes

Remove os.system

f380aae

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft reviewed Aug 31, 2022

View reviewed changes

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py Outdated Show resolved Hide resolved

qiluo-msft reviewed Aug 31, 2022

View reviewed changes

device/juniper/x86_64-juniper_qfx5200-r0/plugins/qfx5200_eeprom_data.py Outdated Show resolved Hide resolved

qiluo-msft reviewed Aug 31, 2022

View reviewed changes

device/juniper/x86_64-juniper_qfx5210-r0/plugins/qfx5210_eeprom_data.py Outdated Show resolved Hide resolved

maipbui added 3 commits September 1, 2022 03:55

Remove shutil and use subprocess and with

2fa4ded

Signed-off-by: maipbui <maibui@microsoft.com>

Use with

109303e

Signed-off-by: maipbui <maibui@microsoft.com>

Simplify code

d40d086

Signed-off-by: maipbui <maibui@microsoft.com>

Fix lgtm

b44a588

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft approved these changes Sep 1, 2022

View reviewed changes

maipbui marked this pull request as ready for review September 2, 2022 13:34

Output text processing

a000b35

Signed-off-by: maipbui <maibui@microsoft.com>

Replace unsafe funcs in platform

9acf59c

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui requested a review from lguohan as a code owner September 19, 2022 15:26

Fix lgtm

e667990

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft reviewed Sep 19, 2022

View reviewed changes

maipbui added 2 commits October 5, 2022 15:04

Fix PR comments

37496d4

Signed-off-by: maipbui <maibui@microsoft.com>

Merge remote-tracking branch 'upstream/master' into juniper_security

b53376c

Fix lgtm

59ce323

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft approved these changes Oct 17, 2022

View reviewed changes

Fix code to be consistent with original behavior

fb8b24f

Signed-off-by: maipbui <maibui@microsoft.com>

fix lgtm

2b45169

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui merged commit 2f6b34a into sonic-net:master Nov 22, 2022

maipbui deleted the juniper_security branch November 22, 2022 15:46

maipbui added the Static Code Analysis label Nov 23, 2022

Conversation

maipbui commented Aug 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

Uh oh!

Uh oh!

qiluo-msft commented Aug 24, 2022

Uh oh!

lgtm-com bot commented Aug 24, 2022

Uh oh!

Uh oh!

lgtm-com bot commented Aug 31, 2022

Uh oh!

Uh oh!

Uh oh!

lgtm-com bot commented Sep 1, 2022

Uh oh!

maipbui commented Sep 12, 2022

Uh oh!

azure-pipelines bot commented Sep 12, 2022

Uh oh!

maipbui commented Sep 13, 2022

Uh oh!

azure-pipelines bot commented Sep 13, 2022

Uh oh!

lgtm-com bot commented Sep 19, 2022

Uh oh!

qiluo-msft Sep 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Sep 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Sep 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Oct 14, 2022

Choose a reason for hiding this comment

Uh oh!

maipbui Oct 17, 2022

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Oct 17, 2022

Choose a reason for hiding this comment

Uh oh!

lgtm-com bot commented Oct 5, 2022

Uh oh!

maipbui commented Oct 18, 2022

Uh oh!

lgtm-com bot commented Nov 21, 2022

Uh oh!

lgtm-com bot commented Nov 21, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maipbui commented Aug 24, 2022 •

edited

Loading

qiluo-msft Sep 19, 2022 •

edited

Loading

qiluo-msft Sep 19, 2022 •

edited

Loading

qiluo-msft Sep 19, 2022 •

edited

Loading