Down to 39 crit vulnerabilities in docker image. Can't seem to get below that

Dockerfile

@@ -1,5 +1,8 @@
-FROM python:3.6.8
-MAINTAINER albert.merono@vu.nl
+#FROM python:3.6.8
+FROM python:3.9.13
+LABEL org.opencontainers.image.authors="ORIGINAL: albert.merono@vu.nl; THIS VERSION: mark.wilkinson@upm.es"
+LABEL org.opencontainers.image.documentation="https://github.com/markwilkinson/grlc/blob/master/README.md"
+RUN apt-get update && apt-get full-upgrade -y
 
 # Default values for env variables
 ARG GRLC_GITHUB_ACCESS_TOKEN=
@@ -22,13 +25,17 @@ ENV GRLC_INSTALL_DIR="${GRLC_HOME}/grlc" \
     GRLC_RUNTIME_DIR="${GRLC_CACHE_DIR}/runtime"
 
 RUN apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -y nginx git-core logrotate python-pip locales gettext-base sudo build-essential apt-utils \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -y nginx git-core logrotate python3-pip locales gettext-base sudo build-essential apt-utils \
  && update-locale LANG=C.UTF-8 LC_MESSAGES=POSIX \
  && locale-gen en_US.UTF-8 \
  && DEBIAN_FRONTEND=noninteractive dpkg-reconfigure locales \
  && rm -rf /var/lib/apt/lists/*
 
-RUN curl -sL https://deb.nodesource.com/setup_10.x | sudo -E bash -
+RUN apt-get update && apt-get dist-upgrade -y
+
+
+RUN curl -sL https://deb.nodesource.com/setup_14.x | sudo -E bash -
+RUN chmod a+r /usr/share/keyrings/nodesource.gpg
 RUN apt-get update && apt-get install -y nodejs
 
 COPY ./ ${GRLC_INSTALL_DIR}
@@ -48,3 +55,4 @@ VOLUME ["${GRLC_DATA_DIR}", "${GRLC_LOG_DIR}"]
 WORKDIR ${GRLC_INSTALL_DIR}
 ENTRYPOINT ["/sbin/entrypoint.sh"]
 CMD ["app:start"]
+

README.md

@@ -1,9 +1,13 @@
+# Shallot
+## Kinda like grlc, but not as powerful ;-)
+
 <p algin="center"><img src="https://raw.githubusercontent.com/CLARIAH/grlc/master/src/static/grlc_logo_01.png" width="250px"></p>
 
-[![PyPI version](https://badge.fury.io/py/grlc.svg)](https://badge.fury.io/py/grlc)
-[![DOI](https://zenodo.org/badge/46131212.svg)](https://zenodo.org/badge/latestdoi/46131212)
-[![Build Status](https://travis-ci.org/CLARIAH/grlc.svg?branch=master)](https://travis-ci.org/CLARIAH/grlc)
+# NOTE:  This is a highly crippled version of the original grlc server
+
+It is intended to be used in secure environments.  Specifically, the GitHub and YAML file integration has been disabled.  Only local queries will be available.
 
+## Original Documentation from https://raw.githubusercontent.com/CLARIAH/grlc/ is below
 
 grlc, the <b>g</b>it <b>r</b>epository <b>l</b>inked data API <b>c</b>onstructor, automatically builds Web APIs using shared SPARQL queries. http://grlc.io/
 

docker-assets/assets/build/install.sh

@@ -18,11 +18,14 @@ passwd -d ${GRLC_USER}
 
 cd ${GRLC_INSTALL_DIR}
 chown ${GRLC_USER}:${GRLC_USER} ${GRLC_HOME} -R
-
 pip install --upgrade pip
+pip install 'setuptools<58'
+pip install 'docutils'
 pip install .
 
-npm install git2prov
+#npm install git2prov
+#npm audit fix
+
 
 #move nginx logs to ${GITLAB_LOG_DIR}/nginx
 sed -i \
@@ -31,7 +34,7 @@ sed -i \
  /etc/nginx/nginx.conf
 
  # configure gitlab log rotation
- cat > /etc/logrotate.d/grlc << EOF
+ cat > /etc/logrotate.d/grlc << EOF1
  ${GRLC_LOG_DIR}/grlc/*.log {
    weekly
    missingok
@@ -41,10 +44,10 @@ sed -i \
    notifempty
    copytruncate
  }
- EOF
+EOF1
 
  # configure gitlab vhost log rotation
- cat > /etc/logrotate.d/grlc-nginx << EOF
+ cat > /etc/logrotate.d/grlc-nginx << EOF2
  ${GRLC_LOG_DIR}/nginx/*.log {
    weekly
    missingok
@@ -54,4 +57,4 @@ sed -i \
    notifempty
    copytruncate
  }
- EOF
+EOF2

openapi.json

@@ -0,0 +1,229 @@
+{
+  "openapi": "3.0.1",
+  "info": {
+    "title": "Duchenne Parent Project Shallot",
+    "description": "The FAIR Data Point Shallot server for the Duchenne Parent Project",
+    "contact": {
+      "name": "Mark Wilkinson",
+      "url": "https://fairdata.systems"
+    },
+    "version": "local"
+  },
+  "servers": [
+    {
+      "url": "//fairdata.services/api-local/"
+    }
+  ],
+  "paths": {
+    "/count": {
+      "get": {
+        "tags": [
+          "Patient Count"
+        ],
+        "summary": "Returns the number of patients in the registry with the corresponding disease code",
+        "description": "\n\n```\n#+ summary: Returns the number of patients in the registry with the corresponding disease code\n#+ tags:\n#+   - Patient Count\n#+ defaults:\n#+   - type: http://www.orpha.net/ORDO/Orphanet_98896\n#+ endpoint_in_url: False\n\nPREFIX sio: <http://semanticscience.org/resource/>\nselect (count(?p) as ?count) where { \n    ?p sio:SIO_000228 ?role .  # person has role role\n    ?role sio:SIO_000356 ?process . # is realized in process\n    ?process sio:SIO_000229 ?output . #has output output\n    ?output sio:SIO_000628 ?attribute . # output refers to attribute\n\t?attribute a ?_type_iri .  # attribute is a orphacode\n}\n\n```",
+        "parameters": [
+          {
+            "name": "type",
+            "in": "query",
+            "description": "A value of type string (iri) that will substitute ?_type_iri in the original query",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "iri",
+              "default": "http://www.orpha.net/ORDO/Orphanet_98896"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Query response",
+            "content": {
+              "text/csv": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              },
+              "text/html": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Unexpected error",
+            "content": {
+              "text/csv": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              },
+              "text/html": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/kpi-ttd": {
+      "get": {
+        "tags": [
+          "KPI diagnosis-delay"
+        ],
+        "summary": "Returns the Key Performance Indicator of the delay between symptom onset and diagnosis.  This data is aggregated by disease, and by year of diagnosis, and is measured in days.",
+        "description": "\n\n```\n#+ summary: Returns the Key Performance Indicator of the delay between symptom onset and diagnosis.  This data is aggregated by disease, and by year of diagnosis, and is measured in days.\n#+ tags:\n#+ - KPI diagnosis-delay\n#+ defaults:\n#+ \n#+ endpoint_in_url: False\n\n################################################################\n# list diagnosis and time from onset to diagnosis\n################################################################\n\nPREFIX sio: <http://semanticscience.org/resource/> \nPREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>\nPREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>\nPREFIX xsd: <http://www.w3.org/2001/XMLSchema#>\nPREFIX ofn: <http://www.ontotext.com/sparql/functions/>\n\nSELECT DISTINCT ?ORDO ?yearOfDiagnosis (xsd:integer(ROUND(AVG(?timeOnsetToDiagnosis))) as ?avgoffset)\nWHERE {\n    BIND(xsd:integer(ofn:asDays(?onsetdate - ?diagnosisdate)) AS ?timeOnsetToDiagnosis)\n#    BIND(xsd:integer(ofn:asDays(?diagnosisdate - ?onsetdate)) AS ?timeOnsetToDiagnosis)\n    BIND(SUBSTR(str(?diagnosisdate), 1,4) AS ?yearOfDiagnosis)\n    {\n        SELECT  ?ORDO ?diagnosisdate WHERE {\n            GRAPH ?g {\n                ?person sio:SIO_000228 ?role1 .  # person has role role\n                ?role1 sio:SIO_000356 ?process1 . # is realized in process\n                ?process1 a <http://purl.obolibrary.org/obo/NCIT_C18020> .  # diagnostic process\n                ?process1 sio:SIO_000229 ?output1 . #has output output \n                ?output1 a <http://purl.obolibrary.org/obo/NCIT_C154625> .  # diagnosis code\n                ?output1 sio:SIO_000628 ?diagnosis1 . # output refers to attribute\n                ?diagnosis1 a ?ORDO .\n                FILTER(!(?ORDO = sio:SIO_000614)) .  # not an \"attribute\" diagnosis\n\t    \t}\n    \t\t?g sio:SIO_000680 ?startdate .\n    \t\t?startdate sio:SIO_000300 ?diagnosisdate .\n        }\n    }\n    {\n        SELECT  ?onsetdate WHERE {\n            ?person sio:SIO_000228 ?role2 .  # person has role role\n            ?role2 sio:SIO_000356 ?process2 . # is realized in process\n            ?process2 sio:SIO_000229 ?output2 . #has output output\n            ?output2 sio:SIO_000300 ?onsetdate .\n            ?output2 sio:SIO_000628 ?attribute2 . # output refers to attribute\n            ?attribute2 a <http://purl.obolibrary.org/obo/NCIT_C124353> .   \n        }\n    }\n} group by ?ORDO ?yearOfDiagnosis order by ?yearOfDiagnosis ?ORDO\n\n\n```",
+        "responses": {
+          "200": {
+            "description": "Query response",
+            "content": {
+              "text/csv": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              },
+              "text/html": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Unexpected error",
+            "content": {
+              "text/csv": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              },
+              "text/html": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/phenotype-frequencies": {
+      "get": {
+        "tags": [
+          "Phenotype frequency"
+        ],
+        "summary": "Returns the number of patients in the registry that have had a phenotype code at any time",
+        "description": "\n\n```\n#+ summary: Returns the number of patients in the registry that have had a phenotype code at any time\n#+ tags:\n#+ - Phenotype frequency\n#+ defaults:\n#+ \n#+ endpoint_in_url: False\n\nPREFIX sio: <http://semanticscience.org/resource/>\nselect ?type (count(?type) as ?frequency) where {\n  select distinct ?p ?type where {\n    ?p sio:SIO_000228 ?role .  # person has role role\n    ?role sio:SIO_000356 ?process . # is realized in process\n    ?process sio:SIO_000229 ?output . #has output output\n    ?output sio:SIO_000628 ?attribute . # output refers to attribute\n    ?attribute a ?type .\n    FILTER(!(?type = sio:SIO_000614)) .  # not an \"attribute\" type\n  }\n} group by ?type\n\n```",
+        "responses": {
+          "200": {
+            "description": "Query response",
+            "content": {
+              "text/csv": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              },
+              "text/html": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {}
+                  }
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "Unexpected error",
+            "content": {
+              "text/csv": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              },
+              "text/html": {
+                "schema": {
+                  "$ref": "#/components/schemas/Message"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "Message": {
+        "type": "string"
+      }
+    }
+  },
+  "x-original-swagger-version": "2.0"
+}