Merge ~rayveldkamp/qa-regression-testing:tests/dockerio-cve-2021-41092 into qa-regression-testing:master

Proposed by Ray Veldkamp
Status: Merged
Merged at revision: 3ca1f6aab4e2e2e581ae6d1568659902e40380cf
Proposed branch: ~rayveldkamp/qa-regression-testing:tests/dockerio-cve-2021-41092
Merge into: qa-regression-testing:master
Diff against target: 164 lines (+106/-2)
1 file modified
scripts/test-docker.io.py (+106/-2)
Reviewer Review Type Date Requested Status
Steve Beattie (community) Approve
Review via email: mp+411309@code.staging.launchpad.net

Commit message

Add a regression test for CVE-2021-41092 to ensure that bad local
credential store configurations, don't result in login attempts to
registry-1.docker.io being made. This test also includes a TLS
certificate, for hosting a local HTTPS server for testing.

To post a comment you must log in.
Revision history for this message
Seth Arnold (seth-arnold) wrote :

On Thu, Nov 04, 2021 at 05:40:46AM -0000, Ray Veldkamp wrote:
> +def update_hosts_file(entry):
> + '''Add an entry to the END of the system /etc/hosts file. No validation is performed on the entry being inserted.'''
> + subprocess.call(['sed', '-i', '$ a {0}'.format(entry), "/etc/hosts"])

Most of this looks good to me, but I'm a bit surprised to shell out to sed
to add a new line to a file; it is impressive it fits in one line, though
:)

Revision history for this message
Steve Beattie (sbeattie) :
Revision history for this message
Steve Beattie (sbeattie) :
Revision history for this message
Ray Veldkamp (rayveldkamp) wrote :

Thanks for the testlib suggestion, I've updated to use this and removed the shell out function and call in setup().

Revision history for this message
Steve Beattie (sbeattie) wrote :

Thanks, this looks great. I touched up a couple of things and merged the branch:

  - QRT-Packages is space seperated not comma
  - python[23] in xenial (and older) don't support ssl.PROTOCOL_TLS, so fall back to PROTOCOL_TLSv1_2 in that situation

Unrelated to your merge, I also eliminated the deprecation warning from the script using unittest.assertRegexpMatches by replacing it with assertRegex().

I like the quick and dirty https server. testlib_http-test-server.py exists but isn't as amenable to simple usages like this; it'd be a nice improvement to figure out an abstraction to make it possible to use in other tests.

review: Approve

There was an error fetching revisions from git servers. Please try again in a few minutes. If the problem persists, contact Launchpad support.

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
The diff is not available at this time. You can reload the page or download it.

Subscribers

People subscribed via source and target branches