Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Management will now run the following files: at the indicated step o… #48

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Management will now run the following files: at the indicated step o… #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 47 additions & 11 deletions backend/internal/processes/installer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
"math/rand"
"os"
"os/exec"
"path"
"path/filepath"
"regexp"
"strings"
Expand All @@ -39,7 +40,7 @@
func startApplicationInstallTerraform(appConfig *config.AppConfig, location string, application *types.InstalledMarketplaceApplication, meta *marketplace.MarketplaceMetadata, db database.Datastore) {
log.Errorf("Application name is: %s", application.Name)
terraform.AddApplicationToStack(appConfig, location, meta, application, db)
executeTerraformInstall(db, appConfig, meta, application)
executeTerraformInstall(db, appConfig, meta, application, location)
}

func InstallMarketplaceApplication(appConfig *config.AppConfig, location string, installParams *types.ApplicationInstallParams, meta *marketplace.MarketplaceMetadata, db database.Datastore, sync bool) error {
Expand All @@ -55,14 +56,14 @@
terraformModuleName := fmt.Sprintf("%s-%s", installParams.DeploymentName, string(randomChars))

application := &types.InstalledMarketplaceApplication{
Name: installParams.Name,
Version: installParams.Version,
DeploymentName: installParams.DeploymentName,
PackageName: meta.Name,
Source: meta.Package,
Status: "STAGED",
TerraformModuleName: terraformModuleName,
Variables: installParams.Variables,
Name: installParams.Name,
Version: installParams.Version,
DeploymentName: installParams.DeploymentName,
PackageName: meta.Name,
Source: meta.Package,
Status: "STAGED",
TerraformModuleName: terraformModuleName,
Variables: installParams.Variables,
}

db.StoreInstalledMarketplaceApplication(application)
Expand All @@ -84,7 +85,7 @@
}
}

func executeTerraformInstall(db database.Datastore, appConfig *config.AppConfig, meta *marketplace.MarketplaceMetadata, application *types.InstalledMarketplaceApplication) error {
func executeTerraformInstall(db database.Datastore, appConfig *config.AppConfig, meta *marketplace.MarketplaceMetadata, application *types.InstalledMarketplaceApplication, location string) error {
// Create install_logs directory if it doesn't exist
logDir := filepath.Join(appConfig.Workdir, "install_logs")
if err := os.MkdirAll(logDir, 0755); err != nil && !os.IsExist(err) {
Expand All @@ -109,6 +110,27 @@
fetchAllApplications(db)

logfile := filepath.Join(logDir, fmt.Sprintf("%s_%s_install_log", application.Name, application.DeploymentName))

// Open the log file in append mode
fileHandle, err := os.OpenFile(logfile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Copilot Autofix AI 18 days ago

To fix the problem, we need to validate the user input before using it to construct the file path. Specifically, we should ensure that the application.Name and application.DeploymentName fields do not contain any path separators or parent directory references. This can be done by checking for the existence of any path separators ("/" or "\") or ".." sequences in the input, and rejecting the input if any are found.

Suggested changeset 1
backend/internal/processes/installer.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/backend/internal/processes/installer.go b/backend/internal/processes/installer.go
--- a/backend/internal/processes/installer.go
+++ b/backend/internal/processes/installer.go
@@ -88,2 +88,10 @@
 func executeTerraformInstall(db database.Datastore, appConfig *config.AppConfig, meta *marketplace.MarketplaceMetadata, application *types.InstalledMarketplaceApplication, location string) error {
+	// Validate application.Name and application.DeploymentName
+	if strings.Contains(application.Name, "/") || strings.Contains(application.Name, "\\") || strings.Contains(application.Name, "..") {
+		return fmt.Errorf("invalid application name: %s", application.Name)
+	}
+	if strings.Contains(application.DeploymentName, "/") || strings.Contains(application.DeploymentName, "\\") || strings.Contains(application.DeploymentName, "..") {
+		return fmt.Errorf("invalid deployment name: %s", application.DeploymentName)
+	}
+
 	// Create install_logs directory if it doesn't exist
EOF
@@ -88,2 +88,10 @@
func executeTerraformInstall(db database.Datastore, appConfig *config.AppConfig, meta *marketplace.MarketplaceMetadata, application *types.InstalledMarketplaceApplication, location string) error {
// Validate application.Name and application.DeploymentName
if strings.Contains(application.Name, "/") || strings.Contains(application.Name, "\\") || strings.Contains(application.Name, "..") {
return fmt.Errorf("invalid application name: %s", application.Name)
}
if strings.Contains(application.DeploymentName, "/") || strings.Contains(application.DeploymentName, "\\") || strings.Contains(application.DeploymentName, "..") {
return fmt.Errorf("invalid deployment name: %s", application.DeploymentName)
}

// Create install_logs directory if it doesn't exist
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
if err != nil {
log.Fatalf("error opening log file: %s", err)
}
defer fileHandle.Close()

// Check for and run pre-uninstall script if it exists
preInstallScript := path.Join(location, "pre-install.sh")
if _, err := os.Stat(preInstallScript); err == nil {
fileHandle.WriteString("pre-install.sh found, running...\n")
application.Status = "RUNNING PRE-INSTALL SCRIPT"
db.UpdateInstalledMarketplaceApplication(application)
err := runShellScript(application, db, preInstallScript, fileHandle)
if err != nil {
fileHandle.WriteString(err.Error())
return err
}
}

err = terraform.RunTerraformLogOutToFile(appConfig, logfile, executor, "")

if err != nil {
Expand All @@ -128,6 +150,20 @@
fetchAllApplications(db)
return err
}

// Check for and run post-install script if it exists
postInstallScript := path.Join(location, "post-install.sh")
if _, err := os.Stat(postInstallScript); err == nil {
log.Errorf("post-install.sh found, running...")
fileHandle.WriteString("post-install.sh found, running...\n")
application.Status = "RUNNING POST-INSTALL SCRIPT"
db.UpdateInstalledMarketplaceApplication(application)
err := runShellScript(application, db, postInstallScript, fileHandle)
if err != nil {
return err
}
}

application.Status = "COMPLETE"
db.UpdateInstalledMarketplaceApplication(application)
fetchAllApplications(db)
Expand Down Expand Up @@ -270,7 +306,7 @@
func TriggerUninstall(wsManager *websocket.WebSocketManager, userid string, store database.Datastore, received *marketplace.Uninstall, conf *config.AppConfig) error {
if received.All == true {
return UninstallAll(conf, wsManager, userid, received)
}
}
// else {
// return UninstallApplication(received.Application, received.DeploymentName, received.DisplayName, conf, store, wsManager, userid)
// }
Expand Down
79 changes: 78 additions & 1 deletion backend/internal/processes/uninstaller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (
"path"
// "strconv"
"fmt"
"os/exec"
"strings"
)

Expand Down Expand Up @@ -50,6 +51,62 @@ func UninstallAll(conf *config.AppConfig, conn *websocket.WebSocketManager, user
return nil
}

func runShellScript(application *types.InstalledMarketplaceApplication, store database.Datastore, scriptPath string, fileHandle *os.File) error {
filename := path.Base(scriptPath)
application.Status = fmt.Sprintf("RUNNING SCRIPT: %s", filename)
store.UpdateInstalledMarketplaceApplication(application)
scriptDir := path.Dir(scriptPath)
cmd := exec.Command("/bin/sh", scriptPath)
cmd.Dir = scriptDir
cmd.Env = os.Environ() // Inherit parent environment

// Create pipes for stdout and stderr
stdout, err := cmd.StdoutPipe()
if err != nil {
return fmt.Errorf("failed to create stdout pipe: %w", err)
}
stderr, err := cmd.StderrPipe()
if err != nil {
return fmt.Errorf("failed to create stderr pipe: %w", err)
}

// Start the command
if err := cmd.Start(); err != nil {
return fmt.Errorf("failed to start script: %w", err)
}

// Create scanner for stdout
outScanner := bufio.NewScanner(stdout)
go func() {
for outScanner.Scan() {
outString := fmt.Sprintf("Script stdout: %s\n", outScanner.Text())
if fileHandle != nil {
fileHandle.WriteString(outString)
}
log.Infof(outString)
}
}()

// Create scanner for stderr
errScanner := bufio.NewScanner(stderr)
go func() {
for errScanner.Scan() {
outString := fmt.Sprintf("Script stderr: %s\n", errScanner.Text())
if fileHandle != nil {
fileHandle.WriteString(outString)
}
log.Infof(outString)
}
}()

// Wait for command to complete
if err := cmd.Wait(); err != nil {
return fmt.Errorf("script failed: %w", err)
}

return nil
}

func UninstallApplication(application *types.InstalledMarketplaceApplication, conf *config.AppConfig, store database.Datastore) error {
// Create uninstall_logs directory if it doesn't exist
logDir := path.Join(conf.Workdir, "uninstall_logs")
Expand All @@ -63,8 +120,21 @@ func UninstallApplication(application *types.InstalledMarketplaceApplication, co
application.Status = "UNINSTALLING"
store.UpdateInstalledMarketplaceApplication(application)

// Check for and run pre-uninstall script if it exists
preUninstallScript := path.Join(conf.Workdir, "terraform", "modules", application.Name, application.Version, "pre-uninstall.sh")
fileHandle, err := os.OpenFile(logfile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
if err != nil {
log.Fatalf("error opening log file: %s", err)
}
defer fileHandle.Close()

err = runShellScript(application, store, preUninstallScript, fileHandle)
if err != nil {
return err
}

// Run a terraform destroy on the module to be uninstalled
err := terraform.DestroyTerraformModule(conf, logfile, executor, application.TerraformModuleName)
err = terraform.DestroyTerraformModule(conf, logfile, executor, application.TerraformModuleName)
if err != nil {
return err
}
Expand Down Expand Up @@ -128,6 +198,13 @@ func UninstallApplication(application *types.InstalledMarketplaceApplication, co
return err
}

// Check for and run pre-uninstall script if it exists
postUninstallScript := path.Join(conf.Workdir, "terraform", "modules", application.Name, application.Version, "post-uninstall.sh")
err := runShellScript(application, store, postUninstallScript, fileHandle)
if err != nil {
return err
}

return nil
}
}
Expand Down
Loading