search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

PR for AI PRP: Request New Web Fingerprint for Airflow #435

Closed W0ngL1 closed 2 months ago

W0ngL1 commented 3 months ago

Hi @maoning, @tooryx

This PR is linked to an accepted AI PRP #415. And it covers version 2.0.0(2020-12-18) to 2.8.3(the latest).

W0ngL1 commented 3 months ago

Hi @maoning, I've fixed it and updated.

maoning commented 3 months ago

@W0ngL1 the /airflow folder is owned by root. Could you update the folder permission to normal users instead?

W0ngL1 commented 3 months ago

@maoning, sorry for forgetting this, I've fixed it.

maoning commented 2 months ago

@maoning, sorry for forgetting this, I've fixed it.

Most of the files are looking good, I still see one issue error: unable to write file 'google/fingerprinters/web/scripts/updater/community/airflow/app/airflow-2.8.3.yaml' mode 100644: No such file or directory.

W0ngL1 commented 2 months ago

Hi @maoning, it worked when I tested it. I'm not sure what's wrong with it, so I delete the duplicate yaml file, please try again.

maoning commented 2 months ago

Hi @maoning, it worked when I tested it. I'm not sure what's wrong with it, so I delete the duplicate yaml file, please try again.

I think the issue is that the top level folder airflow/ still has the root-only write permission. Could you check https://stackoverflow.com/q/10516201? Also, specifically the part about

If you don't see any changes when modifying execute permission, you probably have a configuration in git which ignore file mode.

W0ngL1 commented 2 months ago

@maoning Sorry, I cannot reproduce your issue. I tried the solution above, but git update-index seems change individual files' mode only. And I looked into .git/config for filemode, should I change the project global git config for this issue?

~/GitHub/tsunami-security-scanner-plugins/.git$ pwd
/home/w/GitHub/tsunami-security-scanner-plugins/.git
~/GitHub/tsunami-security-scanner-plugins/.git$ cat config 
[core]
    repositoryformatversion = 0
    filemode = false
    bare = false
    logallrefupdates = true
[remote "origin"]
    url = https://github.com/W0ngL1/tsunami-security-scanner-plugins
    fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
    remote = origin
    merge = refs/heads/master
[branch "dev_fingerprint_airflow"]
    remote = origin
    merge = refs/heads/dev_fingerprint_airflow
maoning commented 2 months ago

@maoning Sorry, I cannot reproduce your issue. I tried the solution above, but git update-index seems change individual files' mode only. And I looked into .git/config for filemode, should I change the project global git config for this issue?

~/GitHub/tsunami-security-scanner-plugins/.git$ pwd
/home/w/GitHub/tsunami-security-scanner-plugins/.git
~/GitHub/tsunami-security-scanner-plugins/.git$ cat config 
[core]
  repositoryformatversion = 0
  filemode = false
  bare = false
  logallrefupdates = true
[remote "origin"]
  url = https://github.com/W0ngL1/tsunami-security-scanner-plugins
  fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
  remote = origin
  merge = refs/heads/master
[branch "dev_fingerprint_airflow"]
  remote = origin
  merge = refs/heads/dev_fingerprint_airflow

Try change the filemode to true and see if you can commit the file/folder mode changes to this PR.

W0ngL1 commented 2 months ago

Hi @maoning, I've change filemode in .git/config to true and change files' mode by chmod -R 755 airflow/

maoning commented 2 months ago

Hi @maoning, I've change filemode in .git/config to true and change files' mode by chmod -R 755 airflow/

Thanks for the update. I realized that there is a github bug, if I do git apply 435.patch, I always get the older version of the patch (with wrong permission). However when I run gh pr checkout 435, everything works :)

W0ngL1 commented 2 months ago

It's good that it's resolved.