Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added SMTP_SSL option with authentication #917

Merged

Conversation

fazledyn-or
Copy link
Contributor

@fazledyn-or fazledyn-or commented Nov 1, 2023

Overview

Details

While triaging your project, our bug fixing tool generated the following message(s)-

In file: server.py, method: _process_responsehandler, a clear-text protocol such as FTP, Telnet or SMTP is used. These protocols transfer data without any encryption, which expose applications to a large range of risks. iCR suggested that data should be transferred over only secure transport channels.

Changes

  • Added support for SMTP_SSL in server.py
  • Added documentation to docs/configuration.rst

Related Issue / Discussion

Testing

No tests were found related to the usage of smtplib module. Running tox command in the project directory resulted in failure. However, I'd be glad to run tests with proper guidance.

Previously Found & Fixed

Additional Information

Sponsorship and Support

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

Contributions and Licensing

(as per https://github.com/geopython/pycsw/blob/master/CONTRIBUTING.rst#contributions-and-licensing)

  • I'd like to contribute "SMTP SSL/TLS feature" to pycsw. I confirm that my contributions to pycsw will be compatible with the pycsw license guidelines at the time of contribution.
  • I have already previously agreed to the pycsw Contributions and Licensing Guidelines

@@ -23,6 +23,9 @@ pycsw's runtime configuration is defined by ``default.cfg``. pycsw ships with a
- **domaincounts**: for GetDomain operations, whether to provide frequency counts for values. Accepted values are ``true`` and ``False``. Default is ``false``
- **profiles**: comma delimited list of profiles to load at runtime (default is none). See :ref:`profiles`
- **smtp_host**: SMTP host for processing ``csw:ResponseHandler`` parameter via outgoing email requests (default is ``localhost``)
- **smtp_user**: SMTP user name related to the account (default is '')
- **smtp_pass**: SMTP password related to the account (default is '')
- **smtp_ssl**: Option to choose between SMTP and SMTP_SSL. To enable it, set the value to ``true`` (default is ``False``)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change to false.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed. Thanks

@tomkralidis tomkralidis merged commit 6692821 into geopython:master Nov 8, 2023
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants