External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-01 00:38:45 -03:30
Code Issues Packages Projects Releases Wiki Activity

Fix a potential security issue in revision storage path name

Browse Source 
It's too stable and could lead to a race condition
This commit is contained in:
Matthew Jones
2017-02-23 16:20:39 -05:00
parent 4e65e6624a
commit fd7c2550ee
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
awx/main/tasks.py
View File

@@ -1129,6 +1129,7 @@ class RunProjectUpdate(BaseTask):
''' '''
Return SSH private key data needed for this project update. Return SSH private key data needed for this project update.
''' '''
handle, self.revision_path = tempfile.mkstemp()
private_data = {} private_data = {}
if project_update.credential: if project_update.credential:
credential = project_update.credential credential = project_update.credential
@@ -1219,7 +1220,7 @@ class RunProjectUpdate(BaseTask):
'scm_clean': project_update.scm_clean, 'scm_clean': project_update.scm_clean,
'scm_delete_on_update': project_update.scm_delete_on_update, 'scm_delete_on_update': project_update.scm_delete_on_update,
'scm_full_checkout': True if project_update.job_type == 'run' else False, 'scm_full_checkout': True if project_update.job_type == 'run' else False,
'scm_revision_output': '/tmp/_{}_syncrev'.format(project_update.id) # TODO: TempFile 'scm_revision_output': self.revision_path
}) })
args.extend(['-e', json.dumps(extra_vars)]) args.extend(['-e', json.dumps(extra_vars)])
args.append('project_update.yml') args.append('project_update.yml')
@@ -1305,7 +1306,7 @@ class RunProjectUpdate(BaseTask):
def post_run_hook(self, instance, status, **kwargs): def post_run_hook(self, instance, status, **kwargs):
if instance.job_type == 'check' and status not in ('failed', 'canceled',): if instance.job_type == 'check' and status not in ('failed', 'canceled',):
p = instance.project p = instance.project
fd = open('/tmp/_{}_syncrev'.format(instance.id), 'r') fd = open(self.revision_path, 'r')
lines = fd.readlines() lines = fd.readlines()
if lines: if lines:
p.scm_revision = lines[0].strip() p.scm_revision = lines[0].strip()
@@ -1313,6 +1314,10 @@ class RunProjectUpdate(BaseTask):
p.save() p.save()
else: else:
logger.error("Could not find scm revision in check") logger.error("Could not find scm revision in check")
try:
os.remove(self.revision_path)
except Exception, e:
logger.error("Failed removing revision tmp file: {}".format(e))
class RunInventoryUpdate(BaseTask): class RunInventoryUpdate(BaseTask):