!112 [sync] PR-105: fix command injection vulnerabilities

From: @openeuler-sync-bot 
Reviewed-by: @zhu-yuncheng 
Signed-off-by: @zhu-yuncheng

0005-fix-apollo-TimedCorrectTask.patch

@@ -0,0 +1,27 @@
+From cb3af79a8237c6b7e083dc8ba7d324bddf395e08 Mon Sep 17 00:00:00 2001
+From: rearcher <123781007@qq.com>
+Date: Tue, 19 Dec 2023 10:59:30 +0800
+Subject: [PATCH] fix apollo TimedCorrectTask
+
+---
+ zeus/database/proxy/host.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/zeus/database/proxy/host.py b/zeus/database/proxy/host.py
+index 441ef21..471390e 100644
+--- a/zeus/database/proxy/host.py
++++ b/zeus/database/proxy/host.py
+@@ -372,7 +372,9 @@ class HostProxy(MysqlProxy):
+             Host.pkey,
+             Host.ssh_user,
+         ]
+-        filters = {Host.user == username}
++        filters = set()
++        if username:
++            filters = {Host.user == username}
+         if host_list:
+             filters.add(Host.host_id.in_(host_list))
+         try:
+-- 
+2.33.0
+

0006-update-verification-method-for-adding-host.patch

@@ -0,0 +1,70 @@
+From 82cd9883bbf5fc95ca1bd38c36a8a2066aeaa4a1 Mon Sep 17 00:00:00 2001
+From: rabbitali <wenxin32@foxmail.com>
+Date: Tue, 19 Dec 2023 11:02:31 +0800
+Subject: [PATCH] update verification method for adding host or updating host
+ info
+
+---
+ zeus/function/verify/host.py | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/zeus/function/verify/host.py b/zeus/function/verify/host.py
+index 461fc12..310373c 100644
+--- a/zeus/function/verify/host.py
++++ b/zeus/function/verify/host.py
+@@ -16,9 +16,7 @@ Author:
+ Description: For host related interfaces
+ """
+ from vulcanus.restful.serialize.validate import ValidateRules
+-from marshmallow import Schema
+-from marshmallow import fields
+-from marshmallow import validate
++from marshmallow import fields, Schema, validate, validates_schema, ValidationError
+ 
+ 
+ class HostSchema(Schema):
+@@ -111,7 +109,7 @@ class AddHostSchema(Schema):
+     validators for parameter of /manage/host/add
+     """
+ 
+-    ssh_user = fields.String(required=True, validate=lambda s: len(s) > 0)
++    ssh_user = fields.String(required=True, validate=lambda s: 32 >= len(s) > 0)
+     password = fields.String(required=True, allow_none=True, validate=lambda s: len(s) >= 0)
+     host_name = fields.String(
+         required=True, validate=[validate.Length(min=1, max=50), ValidateRules.space_character_check]
+@@ -119,8 +117,13 @@ class AddHostSchema(Schema):
+     host_ip = fields.IP(required=True)
+     ssh_pkey = fields.String(required=True, allow_none=True, validate=lambda s: 4096 >= len(s) >= 0)
+     ssh_port = fields.Integer(required=True, validate=lambda s: 65535 >= s > 0)
+-    host_group_name = fields.String(required=True, validate=lambda s: len(s) > 0)
+-    management = fields.Boolean(required=True)
++    host_group_name = fields.String(required=True, validate=lambda s: 20 >= len(s) > 0)
++    management = fields.Boolean(required=True, truthy={True}, falsy={False})
++
++    @validates_schema
++    def check_authentication_info(self, data, **kwargs):
++        if not data.get("ssh_pkey") and not data.get("password"):
++            raise ValidationError("At least one of the password and key needs to be provided")
+ 
+ 
+ class AddHostBatchSchema(Schema):
+@@ -137,10 +140,12 @@ class UpdateHostSchema(Schema):
+     """
+ 
+     host_id = fields.Integer(required=True, validate=lambda s: s > 0)
+-    ssh_user = fields.String(required=False, validate=lambda s: len(s) > 0)
++    ssh_user = fields.String(required=False, validate=lambda s: 32 >= len(s) > 0)
+     password = fields.String(required=False, validate=lambda s: len(s) > 0)
+     ssh_port = fields.Integer(required=False, validate=lambda s: 65535 >= s > 0)
+-    host_name = fields.String(required=False, validate=lambda s: len(s) > 0)
+-    host_group_name = fields.String(required=False, validate=lambda s: len(s) > 0)
+-    management = fields.Boolean(required=False)
++    host_name = fields.String(
++        required=True, validate=[validate.Length(min=1, max=50), ValidateRules.space_character_check]
++    )
++    host_group_name = fields.String(required=False, validate=lambda s: 20 >= len(s) > 0)
++    management = fields.Boolean(required=False, truthy={True}, falsy={False})
+     ssh_pkey = fields.String(required=False, validate=lambda s: 4096 >= len(s) >= 0)
+-- 
+2.33.0
+

0007-update-verification-method-for-host-ip-field.patch

@@ -0,0 +1,34 @@
+From 4dcbd5294f781e71d609036b75922fcb09b469c9 Mon Sep 17 00:00:00 2001
+From: rabbitali <wenxin32@foxmail.com>
+Date: Wed, 20 Dec 2023 15:09:46 +0800
+Subject: [PATCH] update verification method for host ip field
+
+---
+ zeus/function/verify/host.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/zeus/function/verify/host.py b/zeus/function/verify/host.py
+index 310373c..7dedfee 100644
+--- a/zeus/function/verify/host.py
++++ b/zeus/function/verify/host.py
+@@ -114,7 +114,7 @@ class AddHostSchema(Schema):
+     host_name = fields.String(
+         required=True, validate=[validate.Length(min=1, max=50), ValidateRules.space_character_check]
+     )
+-    host_ip = fields.IP(required=True)
++    host_ip = fields.String(required=True, validate=ValidateRules.ipv4_address_check)
+     ssh_pkey = fields.String(required=True, allow_none=True, validate=lambda s: 4096 >= len(s) >= 0)
+     ssh_port = fields.Integer(required=True, validate=lambda s: 65535 >= s > 0)
+     host_group_name = fields.String(required=True, validate=lambda s: 20 >= len(s) > 0)
+@@ -144,7 +144,7 @@ class UpdateHostSchema(Schema):
+     password = fields.String(required=False, validate=lambda s: len(s) > 0)
+     ssh_port = fields.Integer(required=False, validate=lambda s: 65535 >= s > 0)
+     host_name = fields.String(
+-        required=True, validate=[validate.Length(min=1, max=50), ValidateRules.space_character_check]
++        required=False, validate=[validate.Length(min=1, max=50), ValidateRules.space_character_check]
+     )
+     host_group_name = fields.String(required=False, validate=lambda s: 20 >= len(s) > 0)
+     management = fields.Boolean(required=False, truthy={True}, falsy={False})
+-- 
+2.33.0
+

0008-check-host-status-when-query-host-detail.patch

@@ -0,0 +1,111 @@
+From 62e90ee407ab0f28c47fcd51fe8f1078810e7c94 Mon Sep 17 00:00:00 2001
+From: rearcher <123781007@qq.com>
+Date: Thu, 21 Dec 2023 10:15:07 +0800
+Subject: [PATCH] check host status when query host detail
+
+---
+ zeus/host_manager/view.py | 69 ++++++++-------------------------------
+ 1 file changed, 13 insertions(+), 56 deletions(-)
+
+diff --git a/zeus/host_manager/view.py b/zeus/host_manager/view.py
+index 6b31d35..30d05a3 100644
+--- a/zeus/host_manager/view.py
++++ b/zeus/host_manager/view.py
+@@ -265,6 +265,15 @@ class GetHostInfo(BaseResponse):
+         )
+         if status == state.SUCCEED:
+             res["host_info"] = json.loads(host_info)
++
++        # check host status
++        if status == state.SSH_AUTHENTICATION_ERROR:
++            res['status'] = HostStatus.UNESTABLISHED
++        elif status == state.SSH_CONNECTION_ERROR:
++            res['status'] = HostStatus.OFFLINE
++        elif host['status'] != HostStatus.SCANNING:
++            res['status'] = HostStatus.ONLINE
++
+         return res
+ 
+     @staticmethod
+@@ -282,63 +291,12 @@ class GetHostInfo(BaseResponse):
+                     {
+                         "host_id": host_id,
+                         "host_info":{}
++                        "status": null
+                     }
+                     ...
+                 ]
+         """
+-        return [{"host_id": host_id, "host_info": {}} for host_id in host_list]
+-
+-    def analyse_query_result(self, all_host: List[str], multithreading_execute_result: List) -> List:
+-        """
+-        Analyze multi-threaded execution results,
+-        find out the data which fails to execute,
+-        and generate the final execution result.
+-        Args:
+-            all_host(list): e.g
+-                [host_id1, host_id2... ]
+-            multithreading_execute_result(list): e.g
+-                [
+-                    {
+-                    "host_id":"success host id",
+-                    "host_info": {
+-                        "cpu": {...},
+-                        "os":" {...},
+-                        "memory": {...}.
+-                        "disk": [{...}]
+-                        },
+-                    }
+-                ]
+-
+-        Returns:
+-            list: e.g
+-                [
+-                    {
+-                    "host_id":"success host id",
+-                    "host_info": {
+-                        "cpu": {...},
+-                        "os":" {...},
+-                        "memory": {...}.
+-                        "disk": [{...}]
+-                        },
+-                    }.
+-                    {
+-                    "host_id":"fail host id",
+-                    "host_info": {}
+-                    }.
+-                ]
+-
+-
+-        """
+-        host_infos = []
+-        success_host = set()
+-        for result in multithreading_execute_result:
+-            if result.get('host_info'):
+-                host_infos.append(result)
+-                success_host.add(result.get('host_id'))
+-
+-        fail_host = set(all_host) - success_host
+-        host_infos.extend(self.generate_fail_data(fail_host))
+-        return host_infos
++        return [{"host_id": host_id, "host_info": {}, "status": None} for host_id in host_list]
+ 
+     @BaseResponse.handle(schema=GetHostInfoSchema, proxy=HostProxy)
+     def post(self, callback: HostProxy, **params):
+@@ -369,10 +327,9 @@ class GetHostInfo(BaseResponse):
+         # execute multi threading
+         multi_thread_handler = MultiThreadHandler(lambda p: self.get_host_info(*p), tasks, None)
+         multi_thread_handler.create_thread()
+-        result_list = multi_thread_handler.get_result()
++        host_infos = multi_thread_handler.get_result()
+ 
+-        # analyse execute result and generate target data format
+-        host_infos = self.analyse_query_result(params.get('host_list'), result_list)
++        callback.update_host_status(host_infos)
+         return self.response(code=state.SUCCEED, data={"host_infos": host_infos})
+ 
+ 
+-- 
+2.33.0
+

0009-fix-error-log-when-query-host-status.patch

@@ -0,0 +1,47 @@
+From eaf05c0588e595d2f635c6bae867db5f15c3b034 Mon Sep 17 00:00:00 2001
+From: rearcher <123781007@qq.com>
+Date: Sun, 24 Dec 2023 21:01:19 +0800
+Subject: [PATCH] fix log error
+
+---
+ zeus/host_manager/view.py | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/zeus/host_manager/view.py b/zeus/host_manager/view.py
+index 30d05a3..d13868c 100644
+--- a/zeus/host_manager/view.py
++++ b/zeus/host_manager/view.py
+@@ -139,6 +139,10 @@ class GetHostStatus(BaseResponse):
+         """
+         status_code, host_infos = callback.get_host_ssh_info(params)
+ 
++        result_list = []
++        if len(host_infos) == 0:
++            return self.response(code=status_code, data=result_list)
++
+         multi_thread_handler = MultiThreadHandler(lambda p: self.get_host_status(p), host_infos, None)
+         multi_thread_handler.create_thread()
+         result_list = multi_thread_handler.get_result()
+@@ -457,13 +461,16 @@ def verify_ssh_login_info(ssh_login_info: ClientConnectArgs) -> str:
+         )
+         client.close()
+     except socket.error as error:
+-        LOGGER.error(error)
++        LOGGER.info(f"Failed to connect to host %s: %s", ssh_login_info.host_ip, error)
+         return state.SSH_CONNECTION_ERROR
+     except SSHException as error:
+-        LOGGER.error(error)
++        LOGGER.info(f"Failed to connect to host %s: %s", ssh_login_info.host_ip, error)
++        return state.SSH_AUTHENTICATION_ERROR
++    except IndexError:
++        LOGGER.error(f"Failed to connect to host %s because the pkey of the host are missing", ssh_login_info.host_ip)
+         return state.SSH_AUTHENTICATION_ERROR
+     except Exception as error:
+-        LOGGER.error(error)
++        LOGGER.error(f"Failed to connect to host %s: %s", ssh_login_info.host_ip, error)
+         return state.SSH_CONNECTION_ERROR
+ 
+     return state.SUCCEED
+-- 
+Gitee
+

0010-update-the-exception-catching-type-of-the-function.patch

@@ -0,0 +1,33 @@
+From 90076e3a777576a482f37db6f67331ffcd2783fb Mon Sep 17 00:00:00 2001
+From: rabbitali <wenxin32@foxmail.com>
+Date: Wed, 27 Dec 2023 10:35:35 +0800
+Subject: [PATCH] update the exception catching type of the function
+
+---
+ zeus/vulnerability_manage/view.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/zeus/vulnerability_manage/view.py b/zeus/vulnerability_manage/view.py
+index 37ab633..0a3537a 100644
+--- a/zeus/vulnerability_manage/view.py
++++ b/zeus/vulnerability_manage/view.py
+@@ -19,6 +19,7 @@ from flask import Response, request
+ import sqlalchemy
+ import gevent
+ 
++from vulcanus.exceptions import DatabaseConnectionFailed
+ from vulcanus.log.log import LOGGER
+ from vulcanus.restful.resp import state
+ from vulcanus.restful.response import BaseResponse
+@@ -70,7 +71,7 @@ def query_host_basic_info(host_list: list, username: str) -> Tuple[str, Dict]:
+     try:
+         with HostProxy() as proxy:
+             status_code, host_infos = proxy.get_host_info({"host_list": host_list, "username": username})
+-    except sqlalchemy.exc.SQLAlchemyError:
++    except DatabaseConnectionFailed:
+         LOGGER.error("Connect to database error")
+         return state.DATABASE_CONNECT_ERROR, dict()
+ 
+-- 
+2.33.0
+

0011-fix-command-injection-vulnerabilities.patch

@@ -0,0 +1,27 @@
+From 1b2b79f2f3027be1a6d9280b5c091f3a18c5be18 Mon Sep 17 00:00:00 2001
+From: root <root@localhost.localdomain>
+Date: Thu, 7 Mar 2024 09:19:00 +0800
+Subject: [PATCH 1/1] fix command injection vulnerabilities
+
+---
+ zeus/conf/constant.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/zeus/conf/constant.py b/zeus/conf/constant.py
+index 1370d6e..167d6c0 100644
+--- a/zeus/conf/constant.py
++++ b/zeus/conf/constant.py
+@@ -22,8 +22,8 @@ from vulcanus.conf.constant import BASE_CONFIG_PATH
+ MANAGER_CONFIG_PATH = os.path.join(BASE_CONFIG_PATH, 'zeus.ini')
+ 
+ # ceres
+-CERES_PLUGIN_START = "aops-ceres plugin --start %s"
+-CERES_PLUGIN_STOP = "aops-ceres plugin --stop %s"
++CERES_PLUGIN_START = "aops-ceres plugin --start '%s'"
++CERES_PLUGIN_STOP = "aops-ceres plugin --stop '%s'"
+ CERES_COLLECT_ITEMS_CHANGE = "aops-ceres plugin --change-collect-items '%s'"
+ CERES_PLUGIN_INFO = "aops-ceres plugin --info"
+ CERES_APPLICATION_INFO = "aops-ceres collect --application"
+-- 
+2.33.0
+

aops-zeus.spec

@@ -1,6 +1,6 @@
 Name:		aops-zeus
 Version:	v1.4.0
-Release:	2
+Release:	7
 Summary:	A host and user manager service which is the foundation of aops.
 License:	MulanPSL2
 URL:		https://gitee.com/openeuler/%{name}
@@ -9,6 +9,13 @@ Patch0001:      0001-add-interface-for-detecting-host-status.patch
 Patch0002:      0002-update-the-query-host-list-api.patch
 Patch0003:      0003-fix-search_key-validate.patch
 Patch0004:      0004-add-rollback-task-execution-method.patch
+Patch0005:      0005-fix-apollo-TimedCorrectTask.patch
+Patch0006:      0006-update-verification-method-for-adding-host.patch
+Patch0007:      0007-update-verification-method-for-host-ip-field.patch
+Patch0008:      0008-check-host-status-when-query-host-detail.patch
+Patch0009:      0009-fix-error-log-when-query-host-status.patch
+Patch0010:      0010-update-the-exception-catching-type-of-the-function.patch
+Patch0011:      0011-fix-command-injection-vulnerabilities.patch
 
 
 BuildRequires:  python3-setuptools
@@ -49,6 +56,23 @@ cp -r database %{buildroot}/opt/aops/
 
 
 %changelog
+* Thu Mar 07 2024 wenxin<wenxin32@foxmail.com> - v1.4.0-7
+- fix command injection vulnerabilities
+
+* Wed Dec 27 2023 wenxin<wenxin32@foxmail.com> - v1.4.0-6
+- update the exception catching type of the function
+
+* Sun Dec 24 2023 luxuexian<luxuexian@huawei.com> - v1.4.0-5
+- fix error log when query host status
+
+* Thu Dec 21 2023 wenxin<wenxin32@foxmail.com> - v1.4.0-4
+- update verification method for host ip field
+- check host status when query host detail
+
+* Tue Dec 19 2023 wenxin<wenxin32@foxmail.com> - v1.4.0-3
+- update verification method for adding host or updating host info
+- fix apollo TimedCorrectTask
+
 * Mon Dec 18 2023 wenxin<wenxin32@foxmail.com> - v1.4.0-2
 - Add interface for detecting host status.
 - Update query host list api, add a new query method based on host name for it.