Merge latest develop branch into qa #1393
Conversation
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
Signed-off-by: bhavanakarwade <bhavana.karwade@ayanworks.com>
Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>
feat: SSO changes for fetching, update and delete session
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const encryptedToken = CryptoJS.AES.encrypt(JSON.stringify(clientCredential), process.env.CRYPTO_PRIVATE_KEY).toString(); | ||
| const command = `${process.cwd()}/${scriptPath} ${dbUrl}`; | ||
|
|
||
| const { stdout, stderr } = await execPromise(command); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the problem, we should avoid constructing a shell command string and passing it to exec (or its promisified version). Instead, we should use execFile (or its promisified version), which allows us to pass the command and its arguments as separate parameters, avoiding shell interpretation of spaces or metacharacters. Specifically, we should:
- Split the command into the script path and its arguments.
- Use
execFile(or a promisified version) to run the script, passing the script path as the command and the database URL as an argument. - Update the import to use
execFilefromchild_process. - Promisify
execFileinstead ofexec. - Update the call in
importGeoLocationMasterDatato use the new approach.
All changes are within libs/prisma-service/prisma/seed.ts.
| @@ -4,9 +4,9 @@ | ||
| import { PrismaClient } from '@prisma/client'; | ||
| import { CommonConstants } from '../../common/src/common.constant'; | ||
| import * as CryptoJS from 'crypto-js'; | ||
| import { exec } from 'child_process'; | ||
| import { execFile } from 'child_process'; | ||
| import * as util from 'util'; | ||
| const execPromise = util.promisify(exec); | ||
| const execFilePromise = util.promisify(execFile); | ||
|
|
||
| const prisma = new PrismaClient(); | ||
| const logger = new Logger('Init seed DB'); | ||
| @@ -401,9 +400,9 @@ | ||
| throw new Error('Environment variables GEO_LOCATION_MASTER_DATA_IMPORT_SCRIPT or DATABASE_URL are not set.'); | ||
| } | ||
|
|
||
| const command = `${process.cwd()}/${scriptPath} ${dbUrl}`; | ||
| const absoluteScriptPath = `${process.cwd()}/${scriptPath}`; | ||
|
|
||
| const { stdout, stderr } = await execPromise(command); | ||
| const { stdout, stderr } = await execFilePromise(absoluteScriptPath, [dbUrl]); | ||
|
|
||
| if (stdout) { | ||
| logger.log(`Shell script output: ${stdout}`); |
| async function main(): Promise<void> { | ||
| const command = `${process.cwd()}/${scriptPath} ${dbUrl} ${encryptedClientId} ${encryptedClientSecret}`; | ||
|
|
||
| const { stdout, stderr } = await execPromise(command); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the problem, we should avoid constructing a shell command as a single string and passing it to exec (or its promisified version). Instead, we should use execFile (or its promisified version), which takes the command and its arguments as separate parameters, thus avoiding shell interpretation and the associated risks. This means:
- Parse the script path and arguments into an array, not a single string.
- Use
execFileinstead ofexecfor execution. - Promisify
execFileas needed. - Update the import and the
execPromisedefinition. - Update the call site to use the new function signature.
All changes are within libs/prisma-service/prisma/seed.ts:
- Import
execFilefromchild_process. - Promisify
execFileinstead ofexec. - Change the command construction to an array of arguments.
- Use
execFilePromisewith the script path and arguments.
| @@ -4,9 +4,9 @@ | ||
| import { PrismaClient } from '@prisma/client'; | ||
| import { CommonConstants } from '../../common/src/common.constant'; | ||
| import * as CryptoJS from 'crypto-js'; | ||
| import { exec } from 'child_process'; | ||
| import { execFile } from 'child_process'; | ||
| import * as util from 'util'; | ||
| const execPromise = util.promisify(exec); | ||
| const execFilePromise = util.promisify(execFile); | ||
|
|
||
| const prisma = new PrismaClient(); | ||
| const logger = new Logger('Init seed DB'); | ||
| @@ -447,10 +446,10 @@ | ||
| const encryptedClientId = await encryptClientCredential(process.env.KEYCLOAK_MANAGEMENT_CLIENT_ID); | ||
| const encryptedClientSecret = await encryptClientCredential(process.env.KEYCLOAK_MANAGEMENT_CLIENT_SECRET); | ||
|
|
||
| const command = `${process.cwd()}/${scriptPath} ${dbUrl} ${encryptedClientId} ${encryptedClientSecret}`; | ||
| const scriptFullPath = `${process.cwd()}/${scriptPath}`; | ||
| const args = [dbUrl, encryptedClientId, encryptedClientSecret]; | ||
| const { stdout, stderr } = await execFilePromise(scriptFullPath, args); | ||
|
|
||
| const { stdout, stderr } = await execPromise(command); | ||
|
|
||
| if (stdout) { | ||
| logger.log(`Shell script output: ${stdout}`); | ||
| } |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
What?
Merge latest develop branch into qa