Skip to content

Commit

Permalink
Do not allow re-init of the action exec.
Browse files Browse the repository at this point in the history
Disables re-initialization of the executable unless explicitly permitted
via an environment variable PROXY_ALLOW_REINIT == "1", which is generally
useful for local testing and development.
  • Loading branch information
rabbah authored and dgrove-oss committed Jul 5, 2018
1 parent 470cd35 commit 891896f
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 1 deletion.
13 changes: 12 additions & 1 deletion core/actionProxy/actionproxy.py
Original file line number Diff line number Diff line change
Expand Up @@ -203,16 +203,26 @@ def initCodeFromZip(self, message):

proxy = flask.Flask(__name__)
proxy.debug = False
# disable re-initialization of the executable unless explicitly allowed via an environment
# variable PROXY_ALLOW_REINIT == "1" (this is generally useful for local testing and development)
proxy.rejectReinit = 'PROXY_ALLOW_REINIT' not in os.environ or os.environ['PROXY_ALLOW_REINIT'] != "1"
proxy.initialized = False
runner = None


def setRunner(r):
global runner
runner = r


@proxy.route('/init', methods=['POST'])
def init():
if proxy.rejectReinit is True and proxy.initialized is True:
msg = 'Cannot initialize the action more than once.'
sys.stderr.write(msg + '\n')
response = flask.jsonify({'error': msg})
response.status_code = 403
return complete(response)

message = flask.request.get_json(force=True, silent=True)
if message and not isinstance(message, dict):
flask.abort(404)
Expand All @@ -228,6 +238,7 @@ def init():
status = False

if status is True:
proxy.initialized = True
return ('OK', 200)
else:
response = flask.jsonify({'error': 'The action failed to generate or locate a binary. See logs for details.'})
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -245,4 +245,5 @@ class ActionProxyContainerTests extends BasicActionRunnerTests with WskActorSyst
testUnicode(stdUnicodeSamples)
testEnv(stdEnvSamples)
testLargeInput(stdLargeInputSamples)
testInitCannotBeCalledMoreThanOnce(codeNotReturningJson) // any code sample will do
}

1 comment on commit 891896f

@abergmann
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CVE-2018-11757 was assigned to this issue.

Please sign in to comment.