Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #11913: no reporting if value to report contains a variable #674

Conversation

VinceMacBuche
Copy link
Member

tools/ncf.py Outdated
class_parameter_id = method_info["class_parameter_id"]
class_parameter_name = method_info["parameter"][class_parameter_id]["name"]
class_parameter_value = method_call["args"][class_parameter_id]
content.append(' "'+promiser+'_context" usebundle => current_technique_report_info("'+method_info["name"]+'", "'+class_parameter_name+'", "'+class_parameter_value+'");')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it properly escaped ? what if it component key contains " or ' ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't match current_technique_report_info call, the first parameter is technique_name

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ncharles ! this needs escaping you are right :( :(

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @peckpeck it should be the technique name not the method name ...

@VinceMacBuche
Copy link
Member Author

Commit modified

@VinceMacBuche VinceMacBuche force-pushed the arch_11913/no_reporting_if_value_to_report_contains_a_variable branch from bd4d6d8 to 7e370c1 Compare January 4, 2018 09:28
@VinceMacBuche
Copy link
Member Author

Commit modified

@VinceMacBuche VinceMacBuche force-pushed the arch_11913/no_reporting_if_value_to_report_contains_a_variable branch from 7e370c1 to c369e7d Compare January 4, 2018 09:41
@VinceMacBuche
Copy link
Member Author

Commit modified

@VinceMacBuche VinceMacBuche force-pushed the arch_11913/no_reporting_if_value_to_report_contains_a_variable branch from c369e7d to 4649b16 Compare January 4, 2018 15:58
@VinceMacBuche
Copy link
Member Author

PR rebased

@VinceMacBuche VinceMacBuche force-pushed the arch_11913/no_reporting_if_value_to_report_contains_a_variable branch from 4649b16 to d37ea25 Compare January 5, 2018 15:34
@VinceMacBuche
Copy link
Member Author

Commit modified

@VinceMacBuche VinceMacBuche force-pushed the arch_11913/no_reporting_if_value_to_report_contains_a_variable branch from d37ea25 to d0cff26 Compare January 8, 2018 10:45
Copy link
Member

@ncharles ncharles left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a question, and a request for indentation :)

@@ -550,6 +550,7 @@ def generate_technique_content(technique, methods):
for method_call in technique["method_calls"]:
method_name = method_call["method_name"]
method_info = methods[method_name]
# regex to match quote characters not preceded by a backslash
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it seems to me it does a little more than backslash, or else the regexes lines 581-583 are not complete

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No it's exactly that, the regex here in 554 is using a negative lookbehind:

(?<!text)

to match quotes not preceded by a backslash

then 581-583 use the regexp defined in 554 to replace the unescaped quotes by an escaped quote

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad ! Thank you for the clarification

"pass3" expression => "pass2";
"pass2" expression => "pass1";
"pass1" expression => "any";
"c_class_prefix" string => canonify("${old_class_prefix}");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you add 2 spaces of indentation ?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's correctly idented, there is no class defined

  vars:
    "c_class_prefix" ...

Copy link
Member Author

@VinceMacBuche VinceMacBuche Jan 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or do indent 6 spaces even if there is no class ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, even if no class

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK from what i read elsewhere we do likewise !! thanks @ncharles !

Copy link
Member Author

@VinceMacBuche VinceMacBuche Jan 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok i reindented with 6 spaces (and the report below is also now indented with 6 spaces)

@VinceMacBuche
Copy link
Member Author

Commit modified

@VinceMacBuche VinceMacBuche force-pushed the arch_11913/no_reporting_if_value_to_report_contains_a_variable branch from d0cff26 to f61dd73 Compare January 8, 2018 11:02
Copy link
Member

@ncharles ncharles left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me !

@Normation-Quality-Assistant
Copy link
Contributor

OK, merging this PR

@Normation-Quality-Assistant Normation-Quality-Assistant merged commit f61dd73 into Normation:master Jan 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants