Fix 349

CHANGELOG.md

@@ -29,6 +29,7 @@ This changelog was started for release 4.2.0.
 - Fixed markupsafe to 2.0.1
 - Increased Galaxy timeout for tests
 - Fix documentation build
+- Force all 'user queries'(ask/sparql interfaces) to go to the unauthenticated endpoint, to increase security (no write permissions)
 
 ### Security
 

askomics/libaskomics/SparqlQuery.py

@@ -273,7 +273,7 @@ def toggle_public(self, graph, public):
         '''.format(graph=graph, public=public)
 
         query_launcher = SparqlQueryLauncher(self.app, self.session)
-        query_launcher.execute_query(self.prefix_query(query))
+        query_launcher.execute_query(self.prefix_query(query), is_update=True)
 
     def get_default_query_with_prefix(self):
         """Get default query with the prefixes

askomics/libaskomics/SparqlQueryLauncher.py

@@ -163,7 +163,7 @@ def load_data_virtuoso(self, file_name, graph, host_url):
         )
 
         query = "LOAD <{}> INTO GRAPH <{}>".format(file_url, graph)
-        return self.execute_query(query)
+        return self.execute_query(query, is_update=True)
 
     def get_triples_from_graph(self, graph):
         """Get triples from a rdflib graph
@@ -206,7 +206,7 @@ def insert_ttl_string(self, ttl_string, graph):
         }}
         '''.format(graph, ttl_string)
 
-        return self.execute_query(query)
+        return self.execute_query(query, is_update=True)
 
     def insert_data(self, ttl, graph, metadata=False):
         """Insert data into the triplesotre using INSERT
@@ -235,7 +235,7 @@ def insert_data(self, ttl, graph, metadata=False):
         }}
         '''.format(graph, triples)
 
-        return self.execute_query(query)
+        return self.execute_query(query, is_update=True)
 
     def drop_dataset(self, graph):
         """Drop the datasets of the triplestore and its metadata
@@ -248,9 +248,9 @@ def drop_dataset(self, graph):
         query = '''
         DROP SILENT GRAPH <{}>
         '''.format(graph)
-        self.execute_query(query, disable_log=True, isql_api=True)
+        self.execute_query(query, disable_log=True, isql_api=True, is_update=True)
 
-    def process_query(self, query, isql_api=False):
+    def process_query(self, query, isql_api=False, is_update=False):
         """Execute a query and return parsed results
 
         Parameters
@@ -263,9 +263,9 @@ def process_query(self, query, isql_api=False):
         list
             Parsed results
         """
-        return self.parse_results(self.execute_query(query, isql_api=isql_api))
+        return self.parse_results(self.execute_query(query, isql_api=isql_api, is_update=is_update))
 
-    def execute_query(self, query, disable_log=False, isql_api=False):
+    def execute_query(self, query, disable_log=False, isql_api=False, is_update=False):
         """Execute a sparql query
 
         Parameters
@@ -299,24 +299,25 @@ def execute_query(self, query, disable_log=False, isql_api=False):
 
             if use_isql:
                 formatted_query = "SPARQL {}".format(query)
-                json = {"command": formatted_query, "disable_log": disable_log, "sparql_select": not self.endpoint.isSparqlUpdateRequest()}
+                json = {"command": formatted_query, "disable_log": disable_log, "sparql_select": not is_update}
                 response = requests.post(url=isql_api_url, json=json)
                 results = response.json()
                 if results["status"] == 500:
                     raise HTTPError("isqlapi: {}".format(results["message"]))
 
             else:
                 # Update
-                if self.endpoint.isSparqlUpdateRequest():
+                if is_update:
                     self.endpoint.setMethod('POST')
-                    # Virtuoso hack
-                    # if self.triplestore == 'virtuoso':
-                    #    self.endpoint.queryType = "SELECT"
-
+                    # Force sending to secure endpoint
+                    self.endpoint.queryType = "INSERT"
                     results = self.endpoint.query()
+
                 # Select
                 else:
                     self.endpoint.setReturnFormat(JSON)
+                    # Force sending to public endpoint
+                    self.endpoint.queryType = "SELECT"
                     results = self.endpoint.query().convert()
 
                 self.query_time = time.time() - start_time

config/askomics.test.ini

@@ -83,7 +83,7 @@ autocomplete_max_results = 20
 # name of the triplestore, can be virtuoso or fuseki
 triplestore = virtuoso
 # Sparql endpoint
-endpoint = http://localhost:8891/sparql-auth
+endpoint = http://localhost:8891/sparql
 # Sparql updatepoint
 updatepoint = http://localhost:8891/sparql-auth
 # Isql API

tests/conftest.py

@@ -489,7 +489,7 @@ def upload_and_integrate_ontology(self):
         # integrate
         int_ontology = self.integrate_file({
             "id": 1,
-        }, set_graph=True, endpoint="http://localhost:8891/sparql-auth")
+        }, set_graph=True, endpoint="http://localhost:8891/sparql")
 
         return {
             "upload": up_ontology,

tests/results/abstraction.json

@@ -525,7 +525,7 @@
     "entities": [
       {
         "endpoints": [
-          "http://localhost:8891/sparql-auth"
+          "http://localhost:8891/sparql"
         ],
         "faldo": true,
         "graphs": [
@@ -540,7 +540,7 @@
       },
       {
         "endpoints": [
-          "http://localhost:8891/sparql-auth"
+          "http://localhost:8891/sparql"
         ],
         "faldo": true,
         "graphs": [
@@ -555,7 +555,7 @@
       },
       {
         "endpoints": [
-          "http://localhost:8891/sparql-auth"
+          "http://localhost:8891/sparql"
         ],
         "faldo": true,
         "graphs": [
@@ -569,7 +569,7 @@
       },
       {
         "endpoints": [
-          "http://localhost:8891/sparql-auth"
+          "http://localhost:8891/sparql"
         ],
         "faldo": false,
         "graphs": [

tests/results/startpoints.json

@@ -8,10 +8,10 @@
     [{
         "endpoints": [{
             "name": "local",
-            "url": "http://localhost:8891/sparql-auth"
+            "url": "http://localhost:8891/sparql"
         }, {
             "name": "local",
-            "url": "http://localhost:8891/sparql-auth"
+            "url": "http://localhost:8891/sparql"
         }],
         "entity":
         "http://askomics.org/test/data/transcript",
@@ -37,10 +37,10 @@
      {
          "endpoints": [{
              "name": "local",
-             "url": "http://localhost:8891/sparql-auth"
+             "url": "http://localhost:8891/sparql"
          }, {
              "name": "local",
-             "url": "http://localhost:8891/sparql-auth"
+             "url": "http://localhost:8891/sparql"
          }],
          "entity":
          "http://askomics.org/test/data/gene",
@@ -70,7 +70,7 @@
      {
          "endpoints": [{
              "name": "local",
-             "url": "http://localhost:8891/sparql-auth"
+             "url": "http://localhost:8891/sparql"
          }],
          "entity":
          "http://askomics.org/test/data/DifferentialExpression",
@@ -89,7 +89,7 @@
      {
          "endpoints": [{
              "name": "local",
-             "url": "http://localhost:8891/sparql-auth"
+             "url": "http://localhost:8891/sparql"
          }],
          "entity":
          "http://askomics.org/test/data/QTL",