search

ejeschke / ginga

The Ginga astronomical FITS file viewer
BSD 3-Clause "New" or "Revised" License
122 stars 77 forks source link

TST: Security audit failed #1080

Closed pllim closed 10 months ago

pllim commented 11 months ago

@ejeschke , please look at https://github.com/ejeschke/ginga/actions/runs/7163626610/job/19502365317 and think about whether we should fix this or slap a # nosec on the offending lines. Thank you.

ejeschke commented 11 months ago

The SimpleXMLRPCServer is only used if the RC (Remote Control) plugin is started. Furthermore, the default host that the server interface starts up on is "localhost", so the server is not exposed outside the local host, unless the user overrides that.

I think we can put a "nosec" on it for now and leave this issue open. I've been thinking about replacing it with something else anyway. The nice thing about SimpleXMLRPCServer is that it didn't require any third party packages. Given that it is in the standard library, perhaps we will see a fix for this down the road in the standard python release...

ejeschke commented 11 months ago

What do you think, @pllim?

pllim commented 11 months ago

# nosec sounds good if you think that is reasonable. I do not use RC feature. Thanks!

ejeschke commented 10 months ago

Closed via #1081