Import contacts via SFTP #765
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
alanzirek
force-pushed
the
import-contacts-sftp
branch
from
3bef987 to
3a0f45d
Compare
utilisation de la propriété fingerprint sur l'objet key https://docs.paramiko.org/en/latest/api/keys.html#paramiko.pkey.PKey.fingerprint
alanzirek
force-pushed
the
import-contacts-sftp
branch
from
67ec57b to
5799cd3
Compare
alanzirek
force-pushed
the
import-contacts-sftp
branch
from
060ad2a to
26b50ea
Compare
alanzirek
force-pushed
the
import-contacts-sftp
branch
from
26b50ea to
fb866ef
Compare
|
|
||
| # Récupère et ajoute le fingerprint du serveur SFTP à la liste des fingerprints autorisés | ||
| client = paramiko.SSHClient() | ||
| client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) |
Check failure
Code scanning / CodeQL
Accepting unknown SSH host keys when using Paramiko High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 hour ago
To fix the problem, we should replace the use of AutoAddPolicy with RejectPolicy. This ensures that the SSH client will only connect to hosts with known and verified keys, maintaining the security of the connection.
We need to modify the code in core/tests/test_fetch_export_agricoll_contacts_file.py to use RejectPolicy instead of AutoAddPolicy. Additionally, we should ensure that the host key is added to the known hosts list before attempting to connect. This can be done by manually adding the host key to the SSHClient object.
| @@ -17,5 +17,7 @@ | ||
| client = paramiko.SSHClient() | ||
| client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) | ||
| client.set_missing_host_key_policy(paramiko.RejectPolicy()) | ||
| client.load_system_host_keys() | ||
| client.connect(settings.SFTP_HOST, settings.SFTP_PORT, settings.SFTP_USERNAME, settings.SFTP_PASSWORD) | ||
| fingerprint = client.get_transport().get_remote_server_key().fingerprint | ||
| client.get_host_keys().add(settings.SFTP_HOST, client.get_transport().get_remote_server_key().get_name(), client.get_transport().get_remote_server_key()) | ||
| original_fingerprints = CleverCloudSftpVerifier.CLEVER_CLOUD_FINGERPRINTS.copy() |
WIP