[Fixes #13936] Support for XLSX File Uploads in GeoNode#13937
[Fixes #13936] Support for XLSX File Uploads in GeoNode#13937
Conversation
Summary of ChangesHello @Gpetrak, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances GeoNode's data upload capabilities by introducing native support for XLSX and XLS file formats. It provides a robust and secure mechanism for ingesting tabular geographic data from Excel spreadsheets, ensuring data integrity through strict validation of headers and coordinates, and integrating seamlessly with the existing upload orchestration. The feature is also made configurable via an environment variable, offering flexibility for deployment. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| except Exception as e: | ||
| logger.exception("XLSX Pre-processing failed") | ||
| raise InvalidInputFileException(detail=f"Failed to securely parse Excel: {str(e)}") |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, to fix this class of problem you should avoid returning raw exception messages or stack traces to the client. Instead, log the full exception (stack trace and message) on the server for debugging, and send a generic, non-sensitive error message back to the user. This preserves observability for developers while preventing attackers from learning about internal structure or configuration.
For this specific code, the best fix without changing functionality is to keep the logger.exception("XLSX Pre-processing failed") call (so the complete exception is still captured in the logs), but change the InvalidInputFileException detail message to a constant, generic string that does not interpolate e. The location to change is in geonode/upload/handlers/xlsx/handler.py, within the XLSXFileHandler.pre_processing method, lines 211–213. We only need to modify line 213 to remove str(e) from the error message, e.g. raise InvalidInputFileException(detail="Failed to securely parse Excel file."). No extra imports or new methods are required, since we are only changing a literal string.
| @@ -210,7 +210,7 @@ | ||
|
|
||
| except Exception as e: | ||
| logger.exception("XLSX Pre-processing failed") | ||
| raise InvalidInputFileException(detail=f"Failed to securely parse Excel: {str(e)}") | ||
| raise InvalidInputFileException(detail="Failed to securely parse the uploaded Excel file.") | ||
|
|
||
| # update the file path in the payload | ||
| _data["files"]["base_file"] = output_file |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for uploading XLSX and XLS files by converting them to CSV during a pre-processing step and then utilizing the existing CSV handler pipeline. While the implementation includes some security considerations, a critical command injection vulnerability was identified in the ogr2ogr command construction and execution flow. This vulnerability could allow an authenticated attacker to achieve remote code execution by uploading a specially crafted XLSX file, and remediation is required to ensure all user-supplied data is properly sanitized before being used in shell commands. Furthermore, a critical issue was found in the is_valid method that incorrectly attempts to validate an XLSX file using a CSV driver, which would block all uploads of this type. There are also several medium-severity recommendations to improve error handling by using more specific exception types instead of generic ones, which will enhance maintainability and provide clearer feedback to users.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #13937 +/- ##
==========================================
+ Coverage 74.19% 74.25% +0.05%
==========================================
Files 944 949 +5
Lines 56468 56841 +373
Branches 7651 7722 +71
==========================================
+ Hits 41899 42209 +310
- Misses 12885 12928 +43
- Partials 1684 1704 +20 🚀 New features to boost your workflow:
|
2 participants
This PR was created accordiding to this issue: #13936
Checklist
For all pull requests:
The following are required only for core and extension modules (they are welcomed, but not required, for contrib modules):
Submitting the PR does not require you to check all items, but by the time it gets merged, they should be either satisfied or inapplicable.