TritonDataCenter / sdc-imgapi

SDC internal API for managing OS images
Mozilla Public License 2.0
5 stars 18 forks source link

TRITON-2326 CVE-2020-7712 Command injection in json TRITON-2327 CVE-2018-3737 Regular Expression Denial of Service in sshpk #47

Closed travispaul closed 1 year ago

travispaul commented 2 years ago
travispaul commented 2 years ago

Test results:

[root@ad937e9a-f2cf-4dfa-bc2c-12ac9d3a02a0 (testdc:imgapi0) /opt/smartdc/imgapi]# /opt/smartdc/imgapi/test/runtests
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  168k  100  168k    0     0   422k      0 --:--:-- --:--:-- --:--:--  422k

# Test config:
# UFDS_URL is ldaps://ufds.testdc.triton.local
# UFDS_ROOTDN is
# UFDS_PASSWORD is ***
# IMGAPI_URL is http://localhost

# Reload test data.
Deleting c58161c0-2547-11e2-a75e-9fdca1940570
imgapi_images::c58161c0-2547-11e2-a75e-9fdca1940570 does not exist
Deleting 47e6af92-daf0-11e0-ac11-473ca1173ab0
imgapi_images::47e6af92-daf0-11e0-ac11-473ca1173ab0 does not exist
Deleting 1fc068b0-13b0-11e2-9f4e-2f3f6a96d9bc
imgapi_images::1fc068b0-13b0-11e2-9f4e-2f3f6a96d9bc does not exist
Deleting 583287ae-366b-11e2-aea4-bf6c552eb39b
imgapi_images::583287ae-366b-11e2-aea4-bf6c552eb39b does not exist
adding new entry "uuid=86055c40-2547-11e2-8a6b-4bb37edc84ba, ou=users, o=smartdc"

adding new entry "uuid=91ba0e64-2547-11e2-a972-df579e5fddb3, ou=users, o=smartdc"

adding new entry "uuid=a0b6b534-2547-11e2-b758-63a2afd747d1, ou=users, o=smartdc"

adding new entry "uuid=ba28f844-8cb4-f141-882d-46d6251e6a9f, ou=users, o=smartdc"

Adding c58161c0-2547-11e2-a75e-9fdca1940570
Adding da58c25a-2547-11e2-9b8d-136daa650e8a
Adding e078a6aa-2547-11e2-8688-03ac37b2b4a0
Adding 7a1b1967-6ecf-1e4c-8f09-f49094cc36ad
Adding 9f819499-8298-9842-8cc5-1c2838196ab4
Adding 2d28c64f-fb16-2145-a0ca-f626aea35c77
# Drop IMGAPI caches.

WARNING: skipping image creation tests (CAN_RUN_TEST=false)

adminimportimage.dc-test.js
✔ AdminImportImage should fail if called for a user
  ✔ got an error
  ✔ err.statusCode
  ✔ body.code
  ✔
✔ AdminImportImage should error on UUID mismatch
  ✔ got an error
  ✔ err.statusCode
  ✔ err.body.code
  ✔
  ✔ err.body has "errors" array
  ✔ err.body.errors[0].field
✔ AdminImportImage should fail if UUID already exists
  ✔ got an error: ImageUuidAlreadyExistsError: image uuid "c58161c0-2547-11e2-a75e-9fdca1940570" already exists
  ✔ err.statusCode
  ✔ err.body.code
  ✔
✔ AdminImportImage should 404 on bogus UUID
  ✔ got an error
  ✔ err.statusCode
  ✔ err.body.code
  ✔
✔ AdminImportImage from local .imgmanifest
  ✔
  ✔ got an image object
  ✔ expected image.uuid matched
  ✔ expected image.published_at matched
  ✔ image.state is unactivated
  ✔ expected inherited_directories matched
  ✔ have image.billing_tags
  ✔
  ✔
  ✔ image.files
  ✔ image.files.0.sha1
  ✔ image.files.0.size
  ✔
  ✔
  ✔
  ✔
  ✔ matches
  ✔
  ✔ md5
  ✔ sha1 matches upload
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204
✔ AdminImportImage from local .dsmanifest
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ inherited_directories
  ✔
  ✔
  ✔ image.files
  ✔ image.files.0.sha1
  ✔ image.files.0.size
  ✔
  ✔
  ✔
  ✔
  ✔ matches
  ✔
  ✔ md5
  ✔ sha1 matches upload
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204
✔ AdminImportImage zvol from local .dsmanifest
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ image.files
  ✔ image.files.0.sha1
  ✔ image.files.0.size
  ✔
  ✔
  ✔
  ✔
  ✔ matches
  ✔
  ✔ md5
  ✔ sha1 matches upload
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204
✔ AdminImportImage from images.smartos.org
  ✔
  ✔
  ✔
  ✔ md5
  ✔ sha1 matches manifest data
  ✔ size matches manifest data
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ image.files
  ✔ image.files.0.sha1
  ✔ image.files.0.size
  ✔
  ✔
  ✔
  ✔
  ✔ matches
  ✔
  ✔ md5
  ✔ sha1 matches upload
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204
✔ AdminImportRemoteImage from images.smartos.org
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204
✔ AdminImportRemoteImage from updates.tritondatacenter.com (dev chan)
  ✔
  ✔ got images
  ✔ have assets images to choose from
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204

adminimportlxdimage.dc-test.js
✔ AdminImportLxdImage should 422 when no alias is provided
  ✔ got an error
  ✔ err.statusCode
  ✔ err.body.code
  ✔
✔ AdminImportLxdImage should fail if called for a user
  ✔ got an error
  ✔ err.statusCode
  ✔ body.code
  ✔
✔ AdminImportLxdImage from registry
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ Array.isArray(files)
  ✔ Should be at least one image file
  ✔ lxd image should have two files
  ✔
  ✔ sha1 matches image data
  ✔
  ✔ sha1 matches image data
  ✔
  ✔ res.statusCode 204

image-basics.dc-test.js
✔ ListImages returns a list
  ✔ ListImages err:
  ✔ images
  ✔ images
✔ ListImages (inclAdminFields)
  ✔ ListImages err:
  ✔ images
  ✔ have at least one image
  ✔ "stor" valuelocal
✔ GetImage 404
  ✔ GetImage 404 error
  ✔ image
  ✔ err.statusCode 404
  ✔ body.code
  ✔ res body has a message
  ✔ res.statusCode 404
✔ GetImage existing
  ✔
  ✔ image
  ✔ image.uuid
✔ CreateImage
  ✔
  ✔
  ✔
  ✔
  ✔ image.files
  ✔ image.files.0.sha1
  ✔ image.files.0.size
  ✔ optional dataset_guid
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ conditional update got error: PreconditionFailedError: if-match 'abcdef' didn't match etag '4b957bdcd5a79531e6f3230c6d23821bdbc26d07'
  ✔ conditional update statusCode
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔
  ✔ matches
  ✔
  ✔ (inclAdminFields) image file stor: local
  ✔
  ✔ md5
  ✔ sha1 matches upload
  ✔ sha1 matches image data
  ✔
  ✔ md5
  ✔ sha1 matches icon upload
  ✔
  ✔
  ✔
  ✔ no icon
  ✔
  ✔ image setError
  ✔
  ✔
  ✔ IMGAPI-249 - WIP expected export error
  ✔
  ✔ res.statusCode 204

image-clone.dc-test.js
✔ clone - setup
  ✔ got an imgapi client
  ✔ got a json client
✔ clone - error when no account provided
  ✔ expect an error when no account provided
  ✔ error statusCode should be 422
  ✔ error should have a body object
  ✔ error code should be InvalidParameter
✔ clone - error when cloning a private image
  ✔ got an error
  ✔ error statusCode should be 404
  ✔ error should have a body object
  ✔ error code should be ResourceNotFound
✔ clone - error when cloning public operator image
  ✔ got an error
  ✔ error statusCode should be 422
  ✔ error should have a body object
  ✔ error code should be ImageNotShared
✔ clone - error when cloning own image
  ✔ got an error
  ✔ error statusCode should be 422
  ✔ error should have a body object
  ✔ error code should be ImageNotShared
✔ clone - clone shared image
  ✔ should not have an error on cloneImage
  ✔ should return an image object
  ✔ cloned image should have a different uuid
✔ clone - clone the same image again
  ✔ should not have an error on cloneImage
  ✔ should return an image object
  ✔ cloned image should have a different uuid
  ✔ cloned image should have a different uuid
✔ clone - error when cloning the cloned image
  ✔ should have a cloned image
  ✔ got an error
  ✔ error statusCode should be 422
  ✔ error should have a body object
  ✔ error code should be ImageNotShared
✔ clone - cleanup
  ✔ should have a cloned image
  ✔ should have a second cloned image
  ✔ should not have an error deleting clone
  ✔ should not have an error deleting second clone

images-as-a-user.dc-test.js
✔ ListImages: vader
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ i-am-your-father-0.0.1
  ✔ base-1.8.1
✔ ListImages: vader, state=all
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ i-am-your-father-0.0.1
  ✔ come-to-the-dark-side-42.1.2
  ✔ he-will-join-us-or-die-1.2.3
  ✔ base-1.8.1
✔ ListImages: vader, state=disabled
  ✔ ListImages err:
  ✔ images
  ✔ only one image
  ✔ disabled image
✔ ListImages: vader, state=unactivated
  ✔ ListImages err:
  ✔ images
  ✔ only one image
  ✔ unactivated image
✔ ListImages: vader, public=false
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ i-am-your-father-0.0.1
  ✔ come-to-the-dark-side-42.1.2
  ✔ he-will-join-us-or-die-1.2.3
  ✔ only the 3 vader images
✔ ListImages: vader, public=true
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ i-am-your-father-0.0.1
  ✔ come-to-the-dark-side-42.1.2
  ✔ he-will-join-us-or-die-1.2.3
✔ ListImages: luke
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ i-am-your-father-0.0.1
  ✔ base-1.8.1
  ✔ come-to-the-dark-side-42.1.2
  ✔ he-will-join-us-or-die-1.2.3
✔ ListImages: vader, type=zone-dataset
  ✔ ListImages err:
  ✔ images
  ✔
✔ ListImages: vader, type=bogus
  ✔ ListImages err:
  ✔ images
  ✔
✔ ListImages: vader, os=smartos
  ✔ ListImages err:
  ✔ images
  ✔
✔ ListImages: vader, os=bogus
  ✔ ListImages err:
  ✔ images
  ✔
✔ ListImages: vader, name=i-am-your-father
  ✔ ListImages err:
  ✔ images
  ✔ just the one
  ✔ i-am-your-father
✔ ListImages: vader, name=~father
  ✔ ListImages err:
  ✔ images
  ✔ just the one
  ✔ i-am-your-father
✔ ListImages: vader, owner=vader, state=all
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ i-am-your-father-0.0.1
  ✔ come-to-the-dark-side-42.1.2
  ✔ he-will-join-us-or-die-1.2.3
  ✔ only vader images
✔ ListImages: luke, owner=vader
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔ just the one
  ✔
✔ ListImages: luke, owner=sdc
  ✔ ListImages err:
  ✔ images
  ✔ images
  ✔
  ✔
✔ ListImages: who can see "base-1.8.1"?
  ✔ account vader can see image base-1.8.1
  ✔ account luke can see image base-1.8.1
  ✔ account emperor can see image base-1.8.1
  ✔ account sdc can see image base-1.8.1
  ✔
✔ ListImages: who can see "nodejs-1.0.0"?
  ✔ account vader can see image nodejs-1.0.0
  ✔ account luke can see image nodejs-1.0.0
  ✔ account emperor can see image nodejs-1.0.0
  ✔ account sdc can see image nodejs-1.0.0
  ✔
✔ ListImages: who can see "base-2.0.0"?
  ✔ account vader cannot see image base-2.0.0
  ✔ account luke cannot see image base-2.0.0
  ✔ account emperor cannot see image base-2.0.0
  ✔ account sdc can see image base-2.0.0
  ✔
✔ ListImages: who can see "i-am-your-father-0.0.1"?
  ✔ account vader can see image i-am-your-father-0.0.1
  ✔ account luke can see image i-am-your-father-0.0.1
  ✔ account emperor cannot see image i-am-your-father-0.0.1
  ✔ account sdc cannot see image i-am-your-father-0.0.1
  ✔
✔ ListImages: who can see "come-to-the-dark-side-42.1.2"?
  ✔ account vader can see image come-to-the-dark-side-42.1.2
  ✔ account luke can see image come-to-the-dark-side-42.1.2
  ✔ account emperor cannot see image come-to-the-dark-side-42.1.2
  ✔ account sdc cannot see image come-to-the-dark-side-42.1.2
  ✔
✔ ListImages: who can see "he-will-join-us-or-die-1.2.3"?
  ✔ account vader can see image he-will-join-us-or-die-1.2.3
  ✔ account luke cannot see image he-will-join-us-or-die-1.2.3
  ✔ account emperor cannot see image he-will-join-us-or-die-1.2.3
  ✔ account sdc cannot see image he-will-join-us-or-die-1.2.3
  ✔
✔ GetImage: who can see "base-1.8.1"?
  ✔ account vader can see image base-1.8.1
  ✔
  ✔ account luke can see image base-1.8.1
  ✔
  ✔ account emperor can see image base-1.8.1
  ✔
  ✔ account sdc can see image base-1.8.1
  ✔
  ✔
✔ GetImage: who can see "nodejs-1.0.0"?
  ✔ account vader can see image nodejs-1.0.0
  ✔
  ✔ account luke can see image nodejs-1.0.0
  ✔
  ✔ account emperor can see image nodejs-1.0.0
  ✔
  ✔ account sdc can see image nodejs-1.0.0
  ✔
  ✔
✔ GetImage: who can see "base-2.0.0"?
  ✔
  ✔ account vader cannot see image base-2.0.0
  ✔
  ✔
  ✔ account luke cannot see image base-2.0.0
  ✔
  ✔
  ✔ account emperor cannot see image base-2.0.0
  ✔
  ✔ account sdc can see image base-2.0.0
  ✔
  ✔
✔ GetImage: who can see "i-am-your-father-0.0.1"?
  ✔ account vader can see image i-am-your-father-0.0.1
  ✔
  ✔ account luke can see image i-am-your-father-0.0.1
  ✔
  ✔
  ✔ account emperor cannot see image i-am-your-father-0.0.1
  ✔
  ✔
  ✔ account sdc cannot see image i-am-your-father-0.0.1
  ✔
  ✔
✔ GetImage: who can see "come-to-the-dark-side-42.1.2"?
  ✔ account vader can see image come-to-the-dark-side-42.1.2
  ✔
  ✔ account luke can see image come-to-the-dark-side-42.1.2
  ✔
  ✔
  ✔ account emperor cannot see image come-to-the-dark-side-42.1.2
  ✔
  ✔
  ✔ account sdc cannot see image come-to-the-dark-side-42.1.2
  ✔
  ✔
✔ GetImage: who can see "he-will-join-us-or-die-1.2.3"?
  ✔ account vader can see image he-will-join-us-or-die-1.2.3
  ✔
  ✔
  ✔ account luke cannot see image he-will-join-us-or-die-1.2.3
  ✔
  ✔
  ✔ account emperor cannot see image he-will-join-us-or-die-1.2.3
  ✔
  ✔
  ✔ account sdc cannot see image he-will-join-us-or-die-1.2.3
  ✔
  ✔
WARNING: skipping xdc tests (IMGAPI_XDC_ENABLED!=true)

ping.test.js
✔ ping
  ✔ ping err:
  ✔ pong
  ✔ expected pong
  ✔ pong.pid
  ✔ pong.version
✔ ping error
  ✔ got error
  ✔ err.statusCode
  ✔ body.code
  ✔ res body has a message
  ✔ no pong
  ✔ 422 statusCode
  ✔ Server header

OK: 458 assertions (68596ms)