search

GNS3 / gns3-server

GNS3 server
GNU General Public License v3.0
768 stars 258 forks source link

Update a test expression to remove a logical short circuit #2287

Closed munahaf closed 9 months ago

munahaf commented 9 months ago

In file: node.py, method: _node_data, a logical expression uses the identity operator. A new object is created inside the identity check operation and then used for matching identity. Since this is a distinct, new object, it will not have identity and will match with anything else. As a result, the identity check will have a logical short circuit and the program may have unintended behavior.

The following binary operation

       data[key] is {}

compares a newly created object with the identity operator which will always evaluate to False.

I suggested that the logical operation should be reviewed for correctness.

Sponsorship and Support:

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

grossmj commented 9 months ago

Thank you.