Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -361,13 +361,17 @@ def _is_session_valid(user, session_id):
# TODO change this method if DCV updates his behaviour.
"""
logger.info("Verifying NICE DCV session validity..")

# Query by uid rather than username to avoid truncation by ps command
uid = subprocess.check_output(["id", "-u", user]).decode("utf-8").strip()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you also test by passing shell=True to check_output?
see https://bandit.readthedocs.io/en/1.7.5/plugins/b603_subprocess_without_shell_equals_true.html


# Remove the first and the last because they are the heading and empty, respectively
# All commands and arguments in this subprocess call are built as literals
processes = subprocess.check_output(["/bin/ps", "aux"]).decode("utf-8").split("\n")[1:-1] # nosec B603
processes = subprocess.check_output(["/bin/ps", "aunx"]).decode("utf-8").split("\n")[1:-1] # nosec B603

# Check the filter is empty
if not next(
filter(lambda process: DCVAuthenticator.check_dcv_process(process, user, session_id), processes), None
filter(lambda process: DCVAuthenticator.check_dcv_process(process, uid, session_id), processes), None
):
raise DCVAuthenticator.IncorrectRequestError("The given session does not exists")
logger.info("The NICE DCV session is valid.")
Expand All @@ -377,21 +381,21 @@ def _verify_session_existence(user, session_id):
retry(DCVAuthenticator._is_session_valid, func_args=[user, session_id], attempts=20, wait=1)

@staticmethod
def check_dcv_process(row, user, session_id):
def check_dcv_process(row, uid, session_id):
"""Check if there is a dcvagent process running for the given user and for the given session_id."""
# row example:
# centos 63 0.0 0.0 4348844 3108 ?? Ss 23Jul19 2:32.46 /usr/libexec/dcv/dcvagent --mode full \
# 1000 63 0.0 0.0 4348844 3108 ?? Ss 23Jul19 2:32.46 /usr/libexec/dcv/dcvagent --mode full \
# --session-id mysession
# ubuntu 2949 0.3 0.4 860568 34328 ? Sl 20:10 0:18 /usr/lib/x86_64-linux-gnu/dcv/dcvagent --mode full \
# 2000 2949 0.3 0.4 860568 34328 ? Sl 20:10 0:18 /usr/lib/x86_64-linux-gnu/dcv/dcvagent --mode full \
# --session-id mysession
fields = row.split()
command_index = 10
session_name_index = 14
user_index = 0
uid_index = 0

return (
fields[command_index].endswith("/dcv/dcvagent")
and fields[user_index] == user
and fields[uid_index] == uid
and fields[session_name_index] == session_id
)

Expand Down