search

ejeschke / ginga

The Ginga astronomical FITS file viewer
BSD 3-Clause "New" or "Revised" License
120 stars 77 forks source link

TST: Security audit failed #1080

Closed pllim closed 5 months ago

pllim commented 7 months ago

@ejeschke , please look at https://github.com/ejeschke/ginga/actions/runs/7163626610/job/19502365317 and think about whether we should fix this or slap a # nosec on the offending lines. Thank you.

ejeschke commented 6 months ago

The SimpleXMLRPCServer is only used if the RC (Remote Control) plugin is started. Furthermore, the default host that the server interface starts up on is "localhost", so the server is not exposed outside the local host, unless the user overrides that.

I think we can put a "nosec" on it for now and leave this issue open. I've been thinking about replacing it with something else anyway. The nice thing about SimpleXMLRPCServer is that it didn't require any third party packages. Given that it is in the standard library, perhaps we will see a fix for this down the road in the standard python release...

ejeschke commented 6 months ago

What do you think, @pllim?

pllim commented 6 months ago

# nosec sounds good if you think that is reasonable. I do not use RC feature. Thanks!

ejeschke commented 5 months ago

Closed via #1081