openstack
/
ironic-inspector
Code Issues Proposed changes
ironic-inspector/ironic_inspector
History
Zane Bitter 67ff87ebca Eliminate SQL injection vulnerability in node_cache 
In node_cache.find_node() we were constructing a raw SQL query using
unescaped data that came in on the wire. This presented an SQL injection
vulnerability. To avoid this, use the query builder from SQLAlchemy to
ensure that any input strings are correctly escaped.

Change-Id: I2b0ffa307ec1aa57538733f2e454d2d7e994d656
Story: #2005678
Task: 30992
(cherry picked from commit 9d107900b2)
 		2019-05-21 10:47:31 +02:00
..
cmd introspection data backend: migration tool 2019-02-27 09:33:02 +08:00
common Merge "Pass reset_interfaces when updating a driver from the rules" 2019-03-15 22:31:46 +00:00
conductor Follow up to introspection data driver api revision 2019-02-26 16:26:45 +08:00
conf Deprecates [processing]store_data_location 2019-02-26 11:49:15 +08:00
locale/en_GB/LC_MESSAGES Imported Translations from Zanata 2018-09-09 06:17:38 +00:00
migrations Use processed bool as key in introspection_data DB table 2019-02-13 14:32:53 -05:00
plugins Merge "Pass reset_interfaces when updating a driver from the rules" 2019-03-15 22:31:46 +00:00
pxe_filter Remove PXE filter logging 2019-03-14 21:11:03 -04:00
test Eliminate SQL injection vulnerability in node_cache 2019-05-21 10:47:31 +02:00
__init__.py Switch to pbr 2015-06-18 16:09:07 +02:00
alembic.ini Add alembic migrations for the inspector database 2015-09-23 14:44:46 +01:00
api_tools.py Add API for listing all introspection statuses 2016-11-21 15:58:24 +01:00
db.py Use processed bool as key in introspection_data DB table 2019-02-13 14:32:53 -05:00
dbsync.py Update version of flake8-import-order package 2017-12-14 11:38:27 -08:00
introspect.py Fix lookup when ipmi_address is a hostname 2019-03-08 15:54:34 +01:00
introspection_state.py Fix pycodestyle warnings/errors now visible with hacking 1.1.0 2018-05-08 23:46:05 +02:00
main.py Follow up to introspection data driver api revision 2019-02-26 16:26:45 +08:00
node_cache.py Eliminate SQL injection vulnerability in node_cache 2019-05-21 10:47:31 +02:00
policy.py Add request context and policy enforcement 2017-10-13 11:55:52 +00:00
process.py Follow up to introspection data driver api revision 2019-02-26 16:26:45 +08:00
rules.py Merge "Allow nested action value formatting" 2018-08-06 13:39:14 +00:00
utils.py introspection data backend: plugin layer 2019-01-07 17:31:15 +08:00
version.py Use Reno for release notes management 2015-11-26 10:12:14 +01:00
wsgi_service.py Wrap Flask into oslo.service 2018-10-23 09:20:16 +08:00