Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenTelemetry for Eclipse Dirigible #4451

Draft
wants to merge 43 commits into
base: master
Choose a base branch
from
Draft

OpenTelemetry for Eclipse Dirigible #4451

wants to merge 43 commits into from
+5,459 −425

Conversation

iliyan-velichkov
Copy link
Contributor

@iliyan-velichkov iliyan-velichkov commented Nov 19, 2024 •
edited
Loading

TODO

@iliyan-velichkov iliyan-velichkov self-assigned this Nov 19, 2024
@iliyan-velichkov iliyan-velichkov marked this pull request as draft November 19, 2024 13:37
github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 20, 2024
View reviewed changes
...ain/java/org/eclipse/dirigible/components/engine/javascript/endpoint/JavascriptEndpoint.java
/**
* Put.
*
* @param projectName the project name

Check failure

Code scanning / CodeQL

Partial path traversal vulnerability from remote Critical

Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.
Partial Path Traversal Vulnerability due to insufficient guard against path traversal from
user-supplied data
Loading
.

Copilot Autofix AI 6 days ago

To fix the partial path traversal vulnerability, we need to ensure that the directory path (registryPath) is slash-terminated before checking if it is a prefix of the user-supplied path. This can be achieved by appending a slash to registryPath if it is not already slash-terminated. Additionally, we should use Path objects to perform the prefix check, as they handle path normalization and comparison more securely.

  1. Modify the isValid method to ensure registryPath is slash-terminated.
  2. Use Path objects to perform the prefix check instead of string comparison.
Suggested changeset 1
components/engine/engine-javascript/src/main/java/org/eclipse/dirigible/components/engine/javascript/endpoint/JavascriptEndpoint.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/components/engine/engine-javascript/src/main/java/org/eclipse/dirigible/components/engine/javascript/endpoint/JavascriptEndpoint.java b/components/engine/engine-javascript/src/main/java/org/eclipse/dirigible/components/engine/javascript/endpoint/JavascriptEndpoint.java
--- a/components/engine/engine-javascript/src/main/java/org/eclipse/dirigible/components/engine/javascript/endpoint/JavascriptEndpoint.java
+++ b/components/engine/engine-javascript/src/main/java/org/eclipse/dirigible/components/engine/javascript/endpoint/JavascriptEndpoint.java
@@ -258,10 +258,10 @@
     public boolean isValid(String inputPath) {
-        String registryPath = getDirigibleWorkingDirectory().toString();
-        String normalizedInputPath = java.nio.file.Path.of(inputPath)
-                                                       .normalize()
-                                                       .toString();
-        File file = new File(registryPath, normalizedInputPath);
+        Path registryPath = getDirigibleWorkingDirectory().toPath().normalize();
+        if (!registryPath.toString().endsWith(File.separator)) {
+            registryPath = registryPath.resolve(File.separator);
+        }
+        Path normalizedInputPath = java.nio.file.Path.of(inputPath).normalize();
+        Path filePath = registryPath.resolve(normalizedInputPath);
         try {
-            return file.getCanonicalPath()
-                       .startsWith(registryPath);
+            return filePath.toFile().getCanonicalPath().startsWith(registryPath.toString());
         } catch (IOException e) {
EOF
@@ -258,10 +258,10 @@
public boolean isValid(String inputPath) {
String registryPath = getDirigibleWorkingDirectory().toString();
String normalizedInputPath = java.nio.file.Path.of(inputPath)
.normalize()
.toString();
File file = new File(registryPath, normalizedInputPath);
Path registryPath = getDirigibleWorkingDirectory().toPath().normalize();
if (!registryPath.toString().endsWith(File.separator)) {
registryPath = registryPath.resolve(File.separator);
}
Path normalizedInputPath = java.nio.file.Path.of(inputPath).normalize();
Path filePath = registryPath.resolve(normalizedInputPath);
try {
return file.getCanonicalPath()
.startsWith(registryPath);
return filePath.toFile().getCanonicalPath().startsWith(registryPath.toString());
} catch (IOException e) {
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
@iliyan-velichkov
Add Spring Boot Admin (SBA)
0cf323a 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add more comments
af23c16 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add authentication and authorization IT
4af966d 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
cleanup
41b7cc8 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
enable liveness and readiness
290a24e 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
increase waiting time in CsvimIT.java
d5f0b7d 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
code formatting
3fc18fb 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
OpenTelemetry spring boot setup
146c6b7 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
update test controller
263993d 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
update service name
3a36188 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
enable actuator metrics report
32c0aaa 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
otel profile and otel meter example
c332101 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
do not call GlobalOpenTelemetry
885822b 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add micrometer counter
6496148 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add custom span with remote call
7f1cf90 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add manual span via code not annotations
bea4555 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add query param as span attribute
0e6c17f 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add span with failure
3147715 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add call with httpclient + create otel module
c2d648f 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add repository calls to the example
492356f 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add trace for scripts execution
3a0e5e9 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add OpenTelmetry stack setup
d72ee92 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
adapt tests
59ccfdc 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
loki cleanup, opensearch using docker profile only
55c11c6 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add Dirigible sample project
0ec0207 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
export traces to debug as well
d68293f 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
update README.md
702fdeb 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
less verbose debug exporter
05d0b31 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
update README.md, update sample project
9ce4489 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add job details to the job execution span
02dc178 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
enable flowable actuator
cb4b533 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
export flowable metrics based on data in flowable actuator endpoint
ba3a8ff 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add traces for BPM tasks execution
051618f 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
more details in js and ts endpoints
75756e4 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
remove span names for the endpoints
7d1e621 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add traces for the synchronizers
da1e136 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
rebase with master
cd86fdb 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
fix flowable close
f75008e 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
update headers
9147afb 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
fix local tests execution
91cda95 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
add custom quartz metrics
81f9b24 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
wip - camel metrics and traces
c1fd7b3 
Signed-off-by: Iliyan Velichkov <[email protected]>
@iliyan-velichkov
code formatting
64d1fd1 
Signed-off-by: Iliyan Velichkov <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@iliyan-velichkov iliyan-velichkov

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@iliyan-velichkov