Open ZuhairORZaki opened 3 weeks ago
Hello here. I am an Apache Airflow maintainer - and we are looking - together with Open Refactory and Alpha-Omega at improving Apache Airflow's Supply Chain security. This one is one of the bugs we found during the checks. We are going to talk about the whole project we are running soon at Airflow Summit - https://airflowsummit.org/ and it would be great to have more succeess stories (we are just starting and expect more activities to come)
Would it be possible to prioritise this fix ?
Overview
In file: init.py,
__all__
includes undefined symbolsNode
,WrappingNode
,node_to_dict
,translate
. This will cause anImportError
when importing the module using star import i.e.from js2py.translators import *
.Possible Fix
One way to fix this issue would be to remove the undefined symbols if they are not needed.
Notes from Triage Team
There is an import statement which imports
trasnlate
rather thantranslate
.This may be causing the
translate
symbol to become undefined.Sponsorship and Support:
This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed - to improve global software supply chain security.
The bug is found by running the iCR tool by OpenRefactory, Inc. and then manually triaging the results.