Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

{Rdbms} Mitigate subprocess security risk #29992

Draft
wants to merge 1 commit into
base: dev
Choose a base branch
from
Draft

{Rdbms} Mitigate subprocess security risk #29992

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 5 additions & 12 deletions src/azure-cli/azure/cli/command_modules/rdbms/_flexible_server_util.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
from knack.prompting import prompt_y_n, NoTTYException
from msrestazure.tools import parse_resource_id
from msrestazure.azure_exceptions import CloudError
from azure.cli.core.util import CLIError
from azure.cli.core.util import CLIError, run_cmd
from azure.cli.core.azclierror import AuthenticationError
from azure.core.exceptions import HttpResponseError
from azure.core.paging import ItemPaged
Expand Down Expand Up @@ -326,13 +326,6 @@ def run_subprocess(command, stdout_show=None):
logger.warning(process.stderr.read().strip().decode('UTF-8'))


def run_subprocess_get_output(command):
commands = command.split()
process = subprocess.Popen(commands, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
process.wait()
return process


def register_credential_secrets(cmd, database_engine, server, repository):
logger.warning('Adding secret "AZURE_CREDENTIALS" to github repository')
resource_group = parse_resource_id(server.id)["resource_group"]
Expand Down Expand Up @@ -376,8 +369,8 @@ def fill_action_template(cmd, database_engine, server, database_name, administra
if not os.path.exists(action_dir):
os.makedirs(action_dir)

process = run_subprocess_get_output("gh secret list --repo {}".format(repository))
github_secrets = process.stdout.read().strip().decode('UTF-8')
process = run_cmd(["gh", "secret", "list", "--repo", repository], capture_output=True)
github_secrets = process.stdout.strip().decode('UTF-8')
# connection_string = AZURE_POSTGRESQL_CONNECTION_STRING if database_engine == 'postgresql' else AZURE_MYSQL_CONNECTION_STRING

if AZURE_CREDENTIALS not in github_secrets:
Expand Down Expand Up @@ -418,8 +411,8 @@ def fill_action_template(cmd, database_engine, server, database_name, administra


def get_git_root_dir():
process = run_subprocess_get_output("git rev-parse --show-toplevel")
return process.stdout.read().strip().decode('UTF-8')
process = run_cmd(["git", "rev-parse", "--show-toplevel"], capture_output=True)
return process.stdout.strip().decode('UTF-8')


def get_user_confirmation(message, yes=False):
Expand Down
9 changes: 4 additions & 5 deletions src/azure-cli/azure/cli/command_modules/rdbms/flexible_server_custom_common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,10 @@
from knack.log import get_logger
from knack.util import CLIError
from urllib.request import urlretrieve
from azure.cli.core.util import sdk_no_wait
from azure.cli.core.util import user_confirmation
from azure.cli.core.util import sdk_no_wait, user_confirmation, run_cmd
from azure.cli.core.azclierror import ClientRequestError, RequiredArgumentMissingError
from ._client_factory import cf_postgres_flexible_replica
from ._flexible_server_util import run_subprocess, run_subprocess_get_output, \
from ._flexible_server_util import run_subprocess, \
fill_action_template, get_git_root_dir, resolve_poller, GITHUB_ACTION_PATH
from .validators import validate_public_access_server

Expand Down Expand Up @@ -206,11 +205,11 @@ def github_actions_run(action_name, branch):


def gitcli_check_and_login():
output = run_subprocess_get_output("gh")
output = run_cmd(["gh"], capture_output=True)
if output.returncode:
raise ClientRequestError('Please install "Github CLI" to run this command.')

output = run_subprocess_get_output("gh auth status")
output = run_cmd(["gh", "auth", "status"], capture_output=True)
if output.returncode:
run_subprocess("gh auth login", stdout_show=True)

Expand Down