From ab9cba7c06a0663e826a778537c5bf2e9f71b621 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 22 Mar 2024 11:19:23 +0100 Subject: [PATCH] Use bind_params to avoid SQL injection --- .github/dependabot.yml | 22 +++ .github/workflows/codeql-analysis.yml | 46 ++++++ .github/workflows/main.yml | 137 ++++++++++++++++++ client/src/__tests__/base.js | 3 - .../__tests__/utils/QueryParameters.test.js | 10 +- client/src/components/CheckBox.jsx | 14 +- client/src/components/GroupBy.jsx | 1 + client/src/index.js | 6 - client/src/pages/Live.jsx | 19 ++- .../src/stylesheets/highchart_overrides.scss | 15 -- client/src/utils/QueryParameters.js | 53 +------ server/api/base.py | 2 +- server/api/stats.py | 2 +- server/api/system.py | 3 +- server/api/user.py | 2 +- server/influx/cq.py | 30 ++-- server/influx/repo.py | 38 +++-- server/test/api/test_stats.py | 16 +- server/test/api/test_system.py | 27 ++-- server/test/api/test_user.py | 18 ++- server/test/influx/test_cq.py | 8 +- 21 files changed, 317 insertions(+), 155 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql-analysis.yml create mode 100644 .github/workflows/main.yml delete mode 100644 client/src/stylesheets/highchart_overrides.scss diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..92070bf --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,22 @@ +--- +version: 2 +updates: + # Maintain dependencies for GitHub Actions + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + + # Maintain dependencies for client + - package-ecosystem: "npm" + directory: "/client" + schedule: + interval: "daily" + open-pull-requests-limit: 10 + + # Maintain dependencies for server + - package-ecosystem: "pip" + directory: "/server" + schedule: + interval: "daily" + open-pull-requests-limit: 10 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 0000000..53ff774 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,46 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ main ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ main ] + schedule: + - cron: '41 3 * * 0' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: [ 'javascript', 'python' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 0000000..6515ddf --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,137 @@ +--- + +name: CI + +on: + # Triggers the workflow on push or pull request events + push: + pull_request: + release: + tags: + - 'v*' + types: [published] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +jobs: + Server_tests: + name: Server tests + + runs-on: ubuntu-latest + + # Test different python versions + strategy: + fail-fast: false + matrix: + python-version: ['3.9'] + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Check out repo + uses: actions/checkout@v2 + - name: Setup InfluxDB + uses: influxdata/influxdb-action@v3 + with: + influxdb_version: 1.11.5 + influxdb_org: influxdata + influxdb_user: "" + influxdb_password: "" + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + cache: 'pip' + cache-dependency-path: 'requirements/*.txt' + + - name: Display Python version + run: | + python -c "import sys; print(sys.version)" + echo coverage: .${{ matrix.coverage }}. + + + - name: Install dependencies + run: | + python -m pip install pip setuptools wheel + pip install --upgrade pip + pip install -r ./requirements/test.txt + pip install flake8 + + - name: Run flake8 + run: | + cd ./server + flake8 . + + - name: Run tests with coverage + run: | + cd ./server + coverage run -m pytest test --cov-report xml --cov=server + timeout-minutes: 20 + + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v4 + with: + token: ${{ secrets.CODECOV_TOKEN }} + if: success() + + + Client_build: + name: Client build + + runs-on: ubuntu-latest + + steps: + - name: Run errands + run: | + sudo apt -y install curl + + - name: Checkout + uses: actions/checkout@v4 + + - name: Get yarn cache directory path + id: yarn-cache-dir-path + run: echo "DIR=$(yarn cache dir)" >> $GITHUB_OUTPUT + + - uses: actions/cache@v4 + id: yarn-cache + with: + path: ${{ steps.yarn-cache-dir-path.outputs.DIR }} + key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }} + restore-keys: | + ${{ runner.os }}-yarn- + + - name: Use Node.js 20 + uses: actions/setup-node@v4 + with: + node-version: "20.11.1" + cache: "yarn" + cache-dependency-path: '**/yarn.lock' + + - name: Install dependencies + shell: bash + run: | + source ~/.nvm/nvm.sh + rm -rf ~/.yarn + curl -o- -L https://yarnpkg.com/install.sh | bash -s -- --version 1.22.19 + export PATH="$HOME/.yarn/bin:$HOME/.config/yarn/global/node_modules/.bin:$PATH" + yarn -v +# nvm install "16.10.0" +# nvm use "16.10.0" + env: + VNM_DIR: ~/.nvm + + - name: Run tests + shell: bash + run: | + cd client + yarn install + CI=true yarn test + yarn build + env: + CI: true + VNM_DIR: ~/.nvm + INLINE_RUNTIME_CHUNK: False + IMAGE_INLINE_SIZE_LIMIT: 0 + timeout-minutes: 15 diff --git a/client/src/__tests__/base.js b/client/src/__tests__/base.js index 95e2ce9..686d78d 100644 --- a/client/src/__tests__/base.js +++ b/client/src/__tests__/base.js @@ -1,8 +1,6 @@ import I18n from "../locale/I18n"; import en from "../locale/en"; import nl from "../locale/nl"; -import Adapter from "enzyme-adapter-react-16"; -import Enzyme from "enzyme" const start = () => { //we need to use them, otherwise the imports are deleted when organizing them @@ -11,7 +9,6 @@ const start = () => { expect(nl).toBeDefined(); I18n.locale = "en"; - Enzyme.configure({ adapter: new Adapter() }) }; test("Test suite must contain at least one test", () => {}); diff --git a/client/src/__tests__/utils/QueryParameters.test.js b/client/src/__tests__/utils/QueryParameters.test.js index 0a3c478..b4ac7e3 100644 --- a/client/src/__tests__/utils/QueryParameters.test.js +++ b/client/src/__tests__/utils/QueryParameters.test.js @@ -2,23 +2,23 @@ import {replaceQueryParameter, getParameterByName} from "../../utils/QueryParame test("Replace query parameters", () => { const replaced = replaceQueryParameter("?test=bogus", "test", "value"); - expect(replaced).toBe("?test=value"); + expect(replaced).toBe("test=value"); }); test("Replace query parameters preserve existing", () => { const replaced = replaceQueryParameter("?test=bogus&name=x", "test", "value"); - expect(replaced).toBe("?name=x&test=value"); + expect(replaced).toBe("test=value&name=x"); }); test("Replace query parameters", () => { const replaced = replaceQueryParameter("", "test", "value"); - expect(replaced).toBe("?test=value"); + expect(replaced).toBe("test=value"); }); test("Parameter by name", () => { - expect("value", getParameterByName("name", "?name=value")) + expect(getParameterByName("name", "?name=value")).toBe("value"); }); test("Parameter by name not exists", () => { - expect("value", getParameterByName("", undefined)) + expect(getParameterByName("nope", "?name=value")).toBe(null); }); \ No newline at end of file diff --git a/client/src/components/CheckBox.jsx b/client/src/components/CheckBox.jsx index 407ce89..4eb16d8 100644 --- a/client/src/components/CheckBox.jsx +++ b/client/src/components/CheckBox.jsx @@ -5,23 +5,19 @@ import Tooltip from "./Tooltip"; export default function CheckBox({name, value, info, onChange, toolTip = null, readOnly = false}) { - const innerOnChange = e => { - e.cancelBubble = true; - e.stopPropagation(); - onChange && onChange(e); - return false; - } - return (
{info &&