diff options
| -rw-r--r-- | archaeological_finds/models_treatments.py | 5 | ||||
| -rw-r--r-- | archaeological_finds/tests.py | 7 | ||||
| -rw-r--r-- | ishtar_common/models_imports.py | 3 | ||||
| -rw-r--r-- | ishtar_common/utils_secretary.py | 19 |
4 files changed, 22 insertions, 12 deletions
diff --git a/archaeological_finds/models_treatments.py b/archaeological_finds/models_treatments.py index 69f0d9d69..ebe842ac7 100644 --- a/archaeological_finds/models_treatments.py +++ b/archaeological_finds/models_treatments.py @@ -18,8 +18,9 @@ # See the file COPYING for details. import datetime -import lxml.etree -import lxml.builder +# nosec: used to build a controlled XML +import lxml.etree # nosec +import lxml.builder # nosec import os import shutil import tempfile diff --git a/archaeological_finds/tests.py b/archaeological_finds/tests.py index 26e9b6dc5..f105093fd 100644 --- a/archaeological_finds/tests.py +++ b/archaeological_finds/tests.py @@ -2066,7 +2066,8 @@ class FindPermissionTest(FindInit, TestPermissionQuery, TestCase): username, password, user = create_superuser() self.users["superuser"] = (username, password, user) - upstream_username, upstream_password, upstream_user = create_user( + # nosec: hard coded password for test purposes + upstream_username, upstream_password, upstream_user = create_user( # nosec username="up", password="up" ) UserProfile.objects.create( @@ -2121,8 +2122,8 @@ class FindPermissionTest(FindInit, TestPermissionQuery, TestCase): self.operations[-1].context_record.all()[0].ishtar_users.add( upstream_user.ishtaruser ) - - associated_username, associated_password, associated_user = create_user( + # nosec: hard coded password for test purposes + associated_username, associated_password, associated_user = create_user( # nosec username="as", password="as" ) UserProfile.objects.create( diff --git a/ishtar_common/models_imports.py b/ishtar_common/models_imports.py index 3d8cce882..528201927 100644 --- a/ishtar_common/models_imports.py +++ b/ishtar_common/models_imports.py @@ -2368,7 +2368,8 @@ class Import(BaseImport): if not col_numbers: return last_column = max(col_numbers) - filename = ".".join(imported_file_path.split('.')[:-1]) + f"-{random.randint(1, 10000):05d}.csv" + # random is not used for cryptographic purpose + filename = ".".join(imported_file_path.split('.')[:-1]) + f"-{random.randint(1, 10000):05d}.csv" # nosec try: data.to_csv(filename, index=False, columns=data.columns[range(last_column)], diff --git a/ishtar_common/utils_secretary.py b/ishtar_common/utils_secretary.py index 0ce4732d4..77a2cbc9b 100644 --- a/ishtar_common/utils_secretary.py +++ b/ishtar_common/utils_secretary.py @@ -2,8 +2,9 @@ # -*- coding: utf-8 -*- import re from secretary import Renderer -from lxml import etree -from xml.dom.minidom import parseString +# source files is from admin user this should be safe +from lxml import etree # nosec +from xml.dom.minidom import parseString # nosec from xml.parsers.expat import ExpatError, ErrorString from PIL import Image @@ -108,10 +109,16 @@ class IshtarSecretaryRenderer(Renderer): result = jinja_template.render(**kwargs) # try to fix xml with mismatched tags - parser = etree.XMLParser(recover=True) - recovered_xml = etree.fromstring(result.encode("ascii", "xmlcharrefreplace"), parser) - - final_xml = parseString(etree.tostring(recovered_xml)) + # source files is from admin user this should be safe + parser = etree.XMLParser(recover=True) # nosec + recovered_xml = etree.fromstring( + result.encode("ascii", "xmlcharrefreplace"), + parser) + + # source files is from admin user this should be safe + final_xml = parseString( # nosec + etree.tostring(recovered_xml) + ) if self.template_images: self.replace_images(final_xml) |