Skip to content

Commit 5860173

Browse files
dd-jydd-jy
committed
Fix the vulnerability
Signed-off-by: Jiyeong Seok <[email protected]>
1 parent 3b14c74 commit 5860173

File tree

3 files changed

+28
-27
lines changed

3 files changed

+28
-27
lines changed

‎script/generate-notice-files.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ def html_escape(text):
7777
def combine_notice_files_html(file_hash, input_dirs, output_filename):
7878
"""Combine notice files in FILE_HASH and output a HTML version to OUTPUT_FILENAME."""
7979

80-
SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(input_dirs) + ")(/.*).txt")
80+
SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(re.escape(input_dirs)) + ")(/.*).txt")
8181

8282
# Set up a filename to row id table (anchors inside tables don't work in
8383
# most browsers, but href's to table row ids do)
@@ -135,7 +135,7 @@ def combine_notice_files_html(file_hash, input_dirs, output_filename):
135135
def combine_notice_files_text(file_hash, input_dirs, output_filename, file_title):
136136
"""Combine notice files in FILE_HASH and output a text version to OUTPUT_FILENAME."""
137137

138-
SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(input_dirs) + ")(/.*).txt")
138+
SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(re.escape(input_dirs)) + ")(/.*).txt")
139139
output_file = open(output_filename, "wb")
140140
print >> output_file, file_title
141141
for value in file_hash:
@@ -150,7 +150,7 @@ def combine_notice_files_text(file_hash, input_dirs, output_filename, file_title
150150
def combine_notice_files_xml(files_with_same_hash, input_dirs, output_filename):
151151
"""Combine notice files in FILE_HASH and output a XML version to OUTPUT_FILENAME."""
152152

153-
SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(input_dirs) + ")(/.*).txt")
153+
SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(re.escape(input_dirs)) + ")(/.*).txt")
154154

155155
# Set up a filename to row id table (anchors inside tables don't work in
156156
# most browsers, but href's to table row ids do)

‎src/fosslight_android/_binary_db_controller.py‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,15 @@
1414
columns = ['filename', 'pathname', 'checksum', 'tlshchecksum', 'ossname', 'ossversion', 'license', 'platformname',
1515
'platformversion']
1616

17+
DB_USER = 'bin_analysis_script_user'
18+
DB_PSWD = 'script_123'
19+
1720

1821
def connect_to_lge_bin_db():
1922
conn = ""
2023
cur = ""
21-
user = 'bin_analysis_script_user'
22-
password = 'script_123'
24+
user = DB_USER
25+
password = DB_PSWD
2326
host_product = 'bat.lge.com'
2427
dbname = 'bat'
2528
port = '5432'
@@ -73,29 +76,29 @@ def get_oss_info_from_db(platform_version, bin_info_list, return_list):
7376

7477
def get_oss_info_by_tlsh_and_filename(file_name, checksum_value, tlsh_value, source_path, platform_version, conn, cur):
7578
sql_statement = "SELECT filename,pathname,checksum,tlshchecksum,ossname,ossversion,license,platformname,platformversion FROM lgematching "
76-
sql_statement_checksum = " WHERE filename='{fname}' AND checksum='{checksum}';".format(fname=file_name,
77-
checksum=checksum_value) # Checking checksum first.
78-
sql_statement_filename = "SELECT tlshchecksum FROM lgematching WHERE filename='{fname}' AND tlshchecksum <> '0' ORDER BY ( " \
79+
sql_statement_checksum = " WHERE filename=%(fname)s AND checksum=%(checksum)s;"
80+
sql_checksum_params = {'fname': file_name, 'checksum': checksum_value}
81+
sql_statement_filename = "SELECT tlshchecksum FROM lgematching WHERE filename=%(fname)s AND tlshchecksum <> '0' ORDER BY ( " \
7982
"CASE " \
80-
"WHEN sourcepath = '{src_path}' AND lower(platformname)='{plat_name}' " \
81-
"AND platformversion='{plat_version}' THEN 1 " \
82-
"WHEN sourcepath = '{src_path}' AND lower(platformname)='{plat_name}' THEN 2 " \
83-
"WHEN lower(platformname)='{plat_name}' AND platformversion='{plat_version}' THEN 3 " \
84-
"WHEN lower(platformname)='{plat_name}' THEN 4 " \
83+
"WHEN sourcepath = %(src_path)s AND lower(platformname)=%(plat_name)s " \
84+
"AND platformversion=%(plat_version)s THEN 1 " \
85+
"WHEN sourcepath = %(src_path)s AND lower(platformname)=%(plat_name)s THEN 2 " \
86+
"WHEN lower(platformname)=%(plat_name)s AND platformversion=%(plat_version)s THEN 3 " \
87+
"WHEN lower(platformname)=%(plat_name)s THEN 4 " \
8588
"ELSE 5 " \
86-
"END), updatedate DESC;".format(fname=file_name, src_path=source_path, plat_version=platform_version,
87-
plat_name="android")
89+
"END), updatedate DESC;"
90+
sql_filename_params = {'fname': file_name, 'src_path': source_path, 'plat_version': platform_version, 'plat_name': "android"}
8891
auto_id_comment = ""
8992
final_result_item = ""
9093
is_new = False
9194

9295
# Match checksum and fileName
93-
df_result = get_list_by_using_query(sql_statement + sql_statement_checksum, columns, conn, cur)
96+
df_result = get_list_by_using_query(sql_statement + sql_statement_checksum, sql_checksum_params, columns, conn, cur)
9497
if df_result is not None and len(df_result) > 0: # Found a file with the same checksum.
9598
final_result_item = df_result
9699
else: # Can't find files that have same name and checksum
97100
# Match tlsh and fileName
98-
df_result = get_list_by_using_query(sql_statement_filename, ['tlshchecksum'], conn, cur)
101+
df_result = get_list_by_using_query(sql_statement_filename, sql_filename_params, ['tlshchecksum'], conn, cur)
99102
if df_result is None or len(df_result) <= 0:
100103
final_result_item = ""
101104
auto_id_comment = "New Binary/"
@@ -116,16 +119,15 @@ def get_oss_info_by_tlsh_and_filename(file_name, checksum_value, tlsh_value, sou
116119

117120
if matched_tlsh != "":
118121
final_result_item = get_list_by_using_query(
119-
sql_statement + " WHERE filename='{fname}' AND tlshchecksum='{tlsh}';".format(fname=file_name,
120-
tlsh=matched_tlsh),
122+
sql_statement + " WHERE filename=%(fname)s AND tlshchecksum=%(tlsh)s;", {'fname': file_name, 'tlsh': matched_tlsh},
121123
columns, conn, cur)
122124

123125
return final_result_item, auto_id_comment, is_new
124126

125127

126-
def get_list_by_using_query(sql_query, columns, conn, cur):
128+
def get_list_by_using_query(sql_query, params, columns, conn, cur):
127129
result_rows = "" # DataFrame
128-
cur.execute(sql_query)
130+
cur.execute(sql_query, params)
129131
rows = cur.fetchall()
130132

131133
if rows is not None and len(rows) > 0:

‎src/fosslight_android/check_package_file.py‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import logging
1212
import json
1313
import sys
14+
import contextlib
1415
from datetime import datetime
1516
from ._util import read_file
1617
from fosslight_util.constant import LOGGER_NAME
@@ -126,13 +127,11 @@ def extract_file(fname):
126127

127128
# Unzip the file.
128129
if fname.endswith(".tar.gz"):
129-
tar = tarfile.open(fname, "r:gz")
130-
tar.extractall(path=extract_path)
131-
tar.close()
130+
with contextlib.closing(tarfile.open(fname, "r:gz")) as t:
131+
t.extractall(path=extract_path)
132132
elif fname.endswith(".tar"):
133-
tar = tarfile.open(fname, "r:")
134-
tar.extractall(path=extract_path)
135-
tar.close()
133+
with contextlib.closing(tarfile.open(fname, "r:")) as t:
134+
t.extractall(path=extract_path)
136135
elif fname.endswith(".zip"):
137136
return unzip(fname, extract_path)
138137
else:

0 commit comments

Comments
 (0)