2226

pending completion

Build # 2226

Build Type

Pull #668

travis-ci

Committed by

okurz

Commit Message

<a href="https://github.com/os-autoinst/openQA/commit/<a class=hub.com/os-autoinst/openQA/commit/a179d941e8941d27a0be7ee72f4a2431dee53643">a179d941e<a href="https://github.com/os-autoinst/openQA/commit/a179d941e8941d27a0be7ee72f4a2431dee53643">&quot;&gt;Fix use of symlinked needle dirs from outside of basedir

This fixes a problem introduced with </a><a class="double-link" href="https://github.com/os-autoinst/openQA/commit/<a class="double-link" href="https://github.com/os-autoinst/openQA/commit/2b8ac3c859e6db1296fbf7f6ff71d0306d9501e8">2b8ac3c85</a>">2b8ac3c85</a><a href="https://github.com/os-autoinst/openQA/commit/a179d941e8941d27a0be7ee72f4a2431dee53643">.
The check for the needledir has been moved where an external file path is used
coming from a REST request where additional care should be taken to ensure a
valid and secure directory. For a &quot;local&quot; definition of the needledir the
check was removed changing the behaviour back to the old way supporting
symlinked needle dirs, e.g. when /local/needles is symlinked into
/var/lib/openqa/share/tests/... instead of being a real subdirectory.

For the &quot;new&quot; feature of an external definition of needle dirs test cases are
(still) missing and should be added before another related change is done.

Fixes gh #667.

Pull Request Pull Request #668: [WIP] Fix use of symlinked needle dirs from outside of basedir

Run Details

3 of 3 new or added lines in 1 file covered. (100.0%)

2883 of 4475 relevant lines covered (64.42%)

55.49 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

74.12

/lib/OpenQA/Utils.pm

package OpenQA::Utils;
use strict;
require 5.002;

use Cwd;
use Carp;
use IPC::Run();
use Mojo::URL;
use Try::Tiny;

require Exporter;
our ($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);
$VERSION = sprintf "%d.%03d", q$Revision: 1.12 $ =~ /(\d+)/g;
@ISA     = qw(Exporter);
@EXPORT  = qw(
  $prj
  $basedir
  $resultdir
  &data_name
  &needle_info
  &needledir
  &productdir
  &testcasedir
  &file_content
  &log_debug
  &log_warning
  &save_base64_png
  &run_cmd_with_log
  &commit_git
  &parse_assets_from_settings
  &bugurl
  &bugref_to_href
  &asset_type_from_setting
  &check_download_url
  &check_download_whitelist
);


if ($0 =~ /\.t$/) {
    # This should result in the 't' directory, even if $0 is in a subdirectory
    my ($tdirname) = $0 =~ qr/((.*\/t\/|^t\/)).+$/;
    $ENV{OPENQA_BASEDIR} ||= $tdirname . 'data';
}

#use lib "/usr/share/openqa/cgi-bin/modules";
use File::Basename;
use Fcntl;
use JSON "decode_json";
our $basedir     = $ENV{OPENQA_BASEDIR} || "/var/lib";
our $prj         = "openqa";
our $resultdir   = "$basedir/$prj/testresults";
our $assetdir    = "$basedir/$prj/factory";
our $isodir      = "$assetdir/iso";
our $imagesdir   = "$basedir/$prj/images";
our $hostname    = $ENV{SERVER_NAME};
our $testcasedir = "$basedir/openqa/share/tests";
our $app;

# the desired new folder structure is
# $testcasedir/<testrepository>
# with "main.pm" and needles being in a productdir under <testrepository>
# defined by $distri forming the full path of
#  $testcasedir/<testrepository>/products/$distri
# with a fallback to searching for the main.pm in the <testrepository> top
# folder. <testrepository> is formed by $distri and $version with path lookup
# but could later on also be defined with a variable if necessary.
# To be backwards compatible we need to search for all combinations of "old/new
# testrepository name" and "old/new folder structure" within the
# testrepository.
sub productdir {
    my ($distri, $version) = @_;

    my $dir = testcasedir($distri, $version);
    return $dir . "/products/$distri" if -e "$dir/products/$distri";
    return $dir;
}

sub testcasedir($$) {
    my $distri  = shift;
    my $version = shift;
    # TODO actually "distri" is misused here. It should rather be something
    # like the name of the repository with all tests
    my $dir = "$testcasedir/$distri";
    $dir .= "-$version" if $version && -e "$dir-$version";

    return $dir;
}

sub needledir {
    my ($distri, $version) = @_;
    return productdir($distri, $version) . '/needles';
}

sub needle_info {
    my $name    = shift;
    my $distri  = shift;
    my $version = shift;
    my $fn      = shift;
    local $/;

    my $needledir = needledir($distri, $version);

    if (!$fn) {
        $fn = "$needledir/$name.json";
    }
    else {
        $needledir = dirname($fn);
        # make sure the directory of the file parameter is a real subdir of
        # testcasedir when applying it as needledir to prevent access
        # outside of the zoo
        if (index(Cwd::realpath($needledir), Cwd::realpath($testcasedir)) != 0) {
            warn "$needledir is not a subdir of $testcasedir";
            return;
        }
    }

    my $JF;
    unless (open($JF, '<', $fn)) {
        warn "$fn: $!";
        return;
    }

    my $needle;
    try {
        $needle = decode_json(<$JF>);
    }
    catch {
        warn "failed to parse $fn: $_";
        # technically not required, $needle should remain undefined. Being superstitious human I add:
        undef $needle;
    }
    finally {
        close($JF);
    };
    return unless $needle;

    my $png_fname = basename($fn, '.json') . ".png";
    my $pngfile = File::Spec->catpath('', $needledir, $png_fname);

    $needle->{needledir} = $needledir;
    $needle->{image}     = $pngfile;
    $needle->{json}      = $fn;
    $needle->{name}      = $name;
    $needle->{distri}    = $distri;
    $needle->{version}   = $version;
    return $needle;
}

sub file_content($;$) {
    my ($fn, $enc) = @_;
    my $mode = "<";
    if ($enc) {
        $mode = "$mode:encoding($enc)";
    }
    open(my $FCONTENT, $mode, $fn) or return;
    local $/;
    my $result = <$FCONTENT>;
    close($FCONTENT);
    return $result;
}

# logging helpers
# Withing Mojo openQA $app is defined and Mojo::Log is used
# Scheduler prints to stdout&stderr -> journal
sub log_debug {
    my ($msg) = @_;
    if ($app && $app->log) {
        $app->log->debug($msg);
    }
    else {
        print "[DEBUG] $msg\n";
    }
}

sub log_info {
    my ($msg) = @_;
    if ($app && $app->log) {
        $app->log->info($msg);
    }
    else {
        print "[INFO] $msg\n";
    }
}

sub log_warning {
    my ($msg) = @_;
    if ($app && $app->log) {
        $app->log->warn($msg);
    }
    else {
        print STDERR "[WARN] $msg\n";
    }
}

sub log_error {
    my ($msg) = @_;
    if ($app && $app->log) {
        $app->log->error($msg);
    }
    else {
        print STDERR "[ERROR] $msg\n";
    }
}

sub save_base64_png($$$) {
    my ($dir, $newfile, $png) = @_;
    return unless $newfile;
    # sanitize
    $newfile =~ s,\.png,,;
    $newfile =~ tr/a-zA-Z0-9-/_/cs;
    open(my $fh, ">", $dir . "/$newfile.png") || die "can't open $dir/$newfile.png: $!";
    use MIME::Base64 qw/decode_base64/;
    $fh->print(decode_base64($png));
    close($fh);
    return $newfile;
}

sub image_md5_filename($) {
    my ($md5) = @_;

    my $prefix = substr($md5, 0, 2);
    $md5 = substr($md5, 2);
    return ($imagesdir . "/$prefix/$md5.png", $imagesdir . "/$prefix/.thumbs/$md5.png");
}

sub run_cmd_with_log($) {
    my ($cmd) = @_;
    my ($stdin, $stdout_err, $ret);
    log_info('Running cmd: ' . join(' ', @$cmd));
    $ret = IPC::Run::run($cmd, \$stdin, '>&', \$stdout_err);
    chomp $stdout_err;
    if ($ret) {
        log_debug($stdout_err);
        log_info('cmd returned 0');
    }
    else {
        log_warning($stdout_err);
        log_error('cmd returned non-zero value');
    }
    return $ret;
}

sub commit_git {
    my ($args) = @_;

    my $dir = $args->{dir};
    if ($dir !~ /^\//) {
        use Cwd qw/abs_path/;
        $dir = abs_path($dir);
    }
    my @git = ('git', '--git-dir', "$dir/.git", '--work-tree', $dir);
    my @files;

    for my $cmd (qw(add rm)) {
        next unless $args->{$cmd};
        push(@files, @{$args->{$cmd}});
        unless (run_cmd_with_log([@git, $cmd, @{$args->{$cmd}}])) {
            return;
        }
    }

    my $message = $args->{message};
    my $user    = $args->{user};
    my $author  = sprintf('--author=%s <%s>', $user->fullname, $user->email);
    unless (run_cmd_with_log([@git, 'commit', '-q', '-m', $message, $author, @files])) {
        return;
    }

    if (($app->config->{'scm git'}->{do_push} || '') eq 'yes') {
        unless (run_cmd_with_log([@git, 'push'])) {
            return;
        }
    }
    return 1;
}

sub asset_type_from_setting {
    my ($setting) = @_;
    if ($setting eq 'ISO' || $setting =~ /^ISO_\d$/) {
        return 'iso';
    }
    if ($setting =~ /^HDD_\d$/) {
        return 'hdd';
    }
    if ($setting =~ /^REPO_\d$/) {
        return 'repo';
    }
    if ($setting =~ /^ASSET_\d$/ || $setting eq 'KERNEL' || $setting eq 'INITRD') {
        return 'other';
    }
    # empty string if this doesn't look like an asset type
    return '';
}

sub parse_assets_from_settings {
    my ($settings) = (@_);
    my $assets = {};

    for my $k (keys %$settings) {
        my $type = asset_type_from_setting($k);
        if ($type) {
            $assets->{$k} = {type => $type, name => $settings->{$k}};
        }
    }

    return $assets;
}

sub bugurl {
    my ($bugref) = @_;
    my %bugrefs = (
        bnc => 'https://bugzilla.novell.com/show_bug.cgi?id=',
        bsc => 'https://bugzilla.suse.com/show_bug.cgi?id=',
        boo => 'https://bugzilla.opensuse.org/show_bug.cgi?id=',
        poo => 'https://progress.opensuse.org/issues/',
    );
    return $bugrefs{$bugref};
}

sub bugref_to_href {
    my ($text) = @_;

    $text =~ s{((bnc|bsc|boo|poo)#(\d+))}{<a href="@{[bugurl($2)]}$3">$1</a>}gi;

    return $text;
}

sub check_download_url {
    # Passed a URL and the download_domains whitelist from openqa.ini.
    # Checks if the host of the URL is in the whitelist. Returns an
    # array: (1, host) if there is a whitelist and the host is not in
    # it, (2, host) if there is no whitelist, and () if we pass. This
    # is used by check_download_whitelist below (and so indirectly by
    # the Iso controller) and directly by the download_asset() Gru
    # task subroutine.
    my ($url, $whitelist) = @_;
    my @okdomains;
    if (defined $whitelist) {
        @okdomains = split(/ /, $whitelist);
    }
    my $host = Mojo::URL->new($url)->host;
    unless (@okdomains) {
        return (2, $host);
    }
    my $ok = 0;
    for my $okdomain (@okdomains) {
        my $quoted = qr/$okdomain/;
        $ok = 1 if ($host =~ /${quoted}$/);
    }
    if ($ok) {
        return ();
    }
    else {
        return (1, $host);
    }
}

sub check_download_whitelist {
    # Passed the params hash ref for a job and the download_domains
    # whitelist read from openqa.ini. Checks that all params ending
    # in _URL (i.e. requesting asset download) specify URLs that are
    # whitelisted. It's provided here so that we can run the check
    # twice, once to return immediately and conveniently from the Iso
    # controller, once again directly in the Gru asset download sub
    # just in case someone somehow manages to bypass the API and
    # create a gru task directly. On failure, returns an array of 4
    # items: the first is 1 if there was a whitelist at all or 2 if
    # there was not, the second is the name of the param for which the
    # check failed, the third is the URL, and the fourth is the host.
    # On success, returns an empty array.

    my ($params, $whitelist) = @_;
    my @okdomains;
    if (defined $whitelist) {
        @okdomains = split(/ /, $whitelist);
    }
    for my $param (keys %$params) {
        next unless ($param =~ /_URL$/);
        my $url = $$params{$param};
        my @check = check_download_url($url, $whitelist);
        next unless (@check);
        # if we get here, we got a failure
        return ($check[0], $param, $url, $check[1]);
    }
    # empty list signals caller that check passed
    return ();
}

1;
# vim: set sw=4 et:

1	package OpenQA::Utils;
2	use strict;	102✔
3	require 5.002;
4
5	use Cwd;	102✔
6	use Carp;	102✔
7	use IPC::Run();	102✔
8	use Mojo::URL;	102✔
9	use Try::Tiny;	102✔
10
11	require Exporter;
12	our ($VERSION, @ISA, @EXPORT, @EXPORT_OK, %EXPORT_TAGS);
13	$VERSION = sprintf "%d.%03d", q$Revision: 1.12 $ =~ /(\d+)/g;
14	@ISA = qw(Exporter);
15	@EXPORT = qw(
16	$prj
17	$basedir
18	$resultdir
19	&data_name
20	&needle_info
21	&needledir
22	&productdir
23	&testcasedir
24	&file_content
25	&log_debug
26	&log_warning
27	&save_base64_png
28	&run_cmd_with_log
29	&commit_git
30	&parse_assets_from_settings
31	&bugurl
32	&bugref_to_href
33	&asset_type_from_setting
34	&check_download_url
35	&check_download_whitelist
36	);
37
38
39	if ($0 =~ /\.t$/) {
40	# This should result in the 't' directory, even if $0 is in a subdirectory
41	my ($tdirname) = $0 =~ qr/((.*\/t\/\|^t\/)).+$/;
42	$ENV{OPENQA_BASEDIR} \|\|= $tdirname . 'data';
43	}
44
45	#use lib "/usr/share/openqa/cgi-bin/modules";
46	use File::Basename;	102✔
47	use Fcntl;	102✔
48	use JSON "decode_json";	102✔
49	our $basedir = $ENV{OPENQA_BASEDIR} \|\| "/var/lib";
50	our $prj = "openqa";
51	our $resultdir = "$basedir/$prj/testresults";
52	our $assetdir = "$basedir/$prj/factory";
53	our $isodir = "$assetdir/iso";
54	our $imagesdir = "$basedir/$prj/images";
55	our $hostname = $ENV{SERVER_NAME};
56	our $testcasedir = "$basedir/openqa/share/tests";
57	our $app;
58
59	# the desired new folder structure is
60	# $testcasedir/<testrepository>
61	# with "main.pm" and needles being in a productdir under <testrepository>
62	# defined by $distri forming the full path of
63	# $testcasedir/<testrepository>/products/$distri
64	# with a fallback to searching for the main.pm in the <testrepository> top
65	# folder. <testrepository> is formed by $distri and $version with path lookup
66	# but could later on also be defined with a variable if necessary.
67	# To be backwards compatible we need to search for all combinations of "old/new
68	# testrepository name" and "old/new folder structure" within the
69	# testrepository.
70	sub productdir {
71	my ($distri, $version) = @_;	7✔
72
73	my $dir = testcasedir($distri, $version);	7✔
74	return $dir . "/products/$distri" if -e "$dir/products/$distri";	7✔
75	return $dir;	7✔
76	}
77
78	sub testcasedir($$) {
79	my $distri = shift;	8✔
80	my $version = shift;	8✔
81	# TODO actually "distri" is misused here. It should rather be something
82	# like the name of the repository with all tests
83	my $dir = "$testcasedir/$distri";	8✔
84	$dir .= "-$version" if $version && -e "$dir-$version";	8✔
85
86	return $dir;	8✔
87	}
88
89	sub needledir {
90	my ($distri, $version) = @_;	7✔
91	return productdir($distri, $version) . '/needles';	7✔
92	}
93
94	sub needle_info {
95	my $name = shift;	4✔
96	my $distri = shift;	4✔
97	my $version = shift;	4✔
98	my $fn = shift;	4✔
99	local $/;	4✔
100
101	my $needledir = needledir($distri, $version);	4✔
102
103	if (!$fn) {	4✔
104	$fn = "$needledir/$name.json";	4✔
105	}
106	else {
107	$needledir = dirname($fn);	×
108	# make sure the directory of the file parameter is a real subdir of
109	# testcasedir when applying it as needledir to prevent access
110	# outside of the zoo
111	if (index(Cwd::realpath($needledir), Cwd::realpath($testcasedir)) != 0) {	×
112	warn "$needledir is not a subdir of $testcasedir";	×
113	return;	×
114	}
115	}
116
117	my $JF;	4✔
118	unless (open($JF, '<', $fn)) {	4✔
119	warn "$fn: $!";	×
120	return;	×
121	}
122
123	my $needle;	4✔
124	try {
125	$needle = decode_json(<$JF>);	4✔
126	}
127	catch {
128	warn "failed to parse $fn: $_";	×
129	# technically not required, $needle should remain undefined. Being superstitious human I add:
130	undef $needle;	×
131	}
132	finally {
133	close($JF);	4✔
134	};	4✔
135	return unless $needle;	4✔
136
137	my $png_fname = basename($fn, '.json') . ".png";	4✔
138	my $pngfile = File::Spec->catpath('', $needledir, $png_fname);	4✔
139
140	$needle->{needledir} = $needledir;	4✔
141	$needle->{image} = $pngfile;	4✔
142	$needle->{json} = $fn;	4✔
143	$needle->{name} = $name;	4✔
144	$needle->{distri} = $distri;	4✔
145	$needle->{version} = $version;	4✔
146	return $needle;	4✔
147	}
148
149	sub file_content($;$) {
150	my ($fn, $enc) = @_;	363✔
151	my $mode = "<";	363✔
152	if ($enc) {	363✔
153	$mode = "$mode:encoding($enc)";	1✔
154	}
155	open(my $FCONTENT, $mode, $fn) or return;	363✔
156	local $/;	363✔
157	my $result = <$FCONTENT>;	363✔
158	close($FCONTENT);	363✔
159	return $result;	363✔
160	}
161
162	# logging helpers
163	# Withing Mojo openQA $app is defined and Mojo::Log is used
164	# Scheduler prints to stdout&stderr -> journal
165	sub log_debug {
166	my ($msg) = @_;	722✔
167	if ($app && $app->log) {	722✔
168	$app->log->debug($msg);	680✔
169	}
170	else {
171	print "[DEBUG] $msg\n";	42✔
172	}
173	}
174
175	sub log_info {
176	my ($msg) = @_;	4✔
177	if ($app && $app->log) {	4✔
178	$app->log->info($msg);	1✔
179	}
180	else {
181	print "[INFO] $msg\n";	3✔
182	}
183	}
184
185	sub log_warning {
186	my ($msg) = @_;	11✔
187	if ($app && $app->log) {	11✔
188	$app->log->warn($msg);	10✔
189	}
190	else {
191	print STDERR "[WARN] $msg\n";	1✔
192	}
193	}
194
195	sub log_error {
196	my ($msg) = @_;	1✔
197	if ($app && $app->log) {	1✔
198	$app->log->error($msg);	×
199	}
200	else {
201	print STDERR "[ERROR] $msg\n";	1✔
202	}
203	}
204
205	sub save_base64_png($$$) {
206	my ($dir, $newfile, $png) = @_;	×
207	return unless $newfile;	×
208	# sanitize
209	$newfile =~ s,\.png,,;	×
210	$newfile =~ tr/a-zA-Z0-9-/_/cs;	×
211	open(my $fh, ">", $dir . "/$newfile.png") \|\| die "can't open $dir/$newfile.png: $!";	×
212	use MIME::Base64 qw/decode_base64/;	102✔
213	$fh->print(decode_base64($png));	×
214	close($fh);	×
215	return $newfile;	×
216	}
217
218	sub image_md5_filename($) {
219	my ($md5) = @_;	×
220
221	my $prefix = substr($md5, 0, 2);	×
222	$md5 = substr($md5, 2);	×
223	return ($imagesdir . "/$prefix/$md5.png", $imagesdir . "/$prefix/.thumbs/$md5.png");	×
224	}
225
226	sub run_cmd_with_log($) {
227	my ($cmd) = @_;	2✔
228	my ($stdin, $stdout_err, $ret);	2✔
229	log_info('Running cmd: ' . join(' ', @$cmd));	2✔
230	$ret = IPC::Run::run($cmd, \$stdin, '>&', \$stdout_err);	2✔
231	chomp $stdout_err;	2✔
232	if ($ret) {	2✔
233	log_debug($stdout_err);	1✔
234	log_info('cmd returned 0');	1✔
235	}
236	else {
237	log_warning($stdout_err);	1✔
238	log_error('cmd returned non-zero value');	1✔
239	}
240	return $ret;	2✔
241	}
242
243	sub commit_git {
244	my ($args) = @_;	×
245
246	my $dir = $args->{dir};	×
247	if ($dir !~ /^\//) {	×
248	use Cwd qw/abs_path/;	102✔
249	$dir = abs_path($dir);	×
250	}
251	my @git = ('git', '--git-dir', "$dir/.git", '--work-tree', $dir);	×
252	my @files;	×
253
254	for my $cmd (qw(add rm)) {	×
255	next unless $args->{$cmd};	×
256	push(@files, @{$args->{$cmd}});	×
257	unless (run_cmd_with_log([@git, $cmd, @{$args->{$cmd}}])) {	×
258	return;	×
259	}
260	}
261
262	my $message = $args->{message};	×
263	my $user = $args->{user};	×
264	my $author = sprintf('--author=%s <%s>', $user->fullname, $user->email);	×
265	unless (run_cmd_with_log([@git, 'commit', '-q', '-m', $message, $author, @files])) {	×
266	return;	×
267	}
268
269	if (($app->config->{'scm git'}->{do_push} \|\| '') eq 'yes') {	×
270	unless (run_cmd_with_log([@git, 'push'])) {	×
271	return;	×
272	}
273	}
274	return 1;	×
275	}
276
277	sub asset_type_from_setting {
278	my ($setting) = @_;	3,208✔
279	if ($setting eq 'ISO' \|\| $setting =~ /^ISO_\d$/) {	3,208✔
280	return 'iso';	200✔
281	}
282	if ($setting =~ /^HDD_\d$/) {	3,008✔
283	return 'hdd';	28✔
284	}
285	if ($setting =~ /^REPO_\d$/) {	2,980✔
286	return 'repo';	×
287	}
288	if ($setting =~ /^ASSET_\d$/ \|\| $setting eq 'KERNEL' \|\| $setting eq 'INITRD') {	2,980✔
289	return 'other';	×
290	}
291	# empty string if this doesn't look like an asset type
292	return '';	2,980✔
293	}
294
295	sub parse_assets_from_settings {
296	my ($settings) = (@_);	239✔
297	my $assets = {};	239✔
298
299	for my $k (keys %$settings) {	239✔
300	my $type = asset_type_from_setting($k);	3,202✔
301	if ($type) {	3,202✔
302	$assets->{$k} = {type => $type, name => $settings->{$k}};	223✔
303	}
304	}
305
306	return $assets;	239✔
307	}
308
309	sub bugurl {
310	my ($bugref) = @_;	20✔
311	my %bugrefs = (	20✔
312	bnc => 'https://bugzilla.novell.com/show_bug.cgi?id=',
313	bsc => 'https://bugzilla.suse.com/show_bug.cgi?id=',
314	boo => 'https://bugzilla.opensuse.org/show_bug.cgi?id=',
315	poo => 'https://progress.opensuse.org/issues/',
316	);
317	return $bugrefs{$bugref};	20✔
318	}
319
320	sub bugref_to_href {
321	my ($text) = @_;	30✔
322
323	$text =~ s{((bnc\|bsc\|boo\|poo)#(\d+))}{<a href="@{[bugurl($2)]}$3">$1</a>}gi;	30✔
324
325	return $text;	30✔
326	}
327
328	sub check_download_url {
329	# Passed a URL and the download_domains whitelist from openqa.ini.
330	# Checks if the host of the URL is in the whitelist. Returns an
331	# array: (1, host) if there is a whitelist and the host is not in
332	# it, (2, host) if there is no whitelist, and () if we pass. This
333	# is used by check_download_whitelist below (and so indirectly by
334	# the Iso controller) and directly by the download_asset() Gru
335	# task subroutine.
336	my ($url, $whitelist) = @_;	8✔
337	my @okdomains;	8✔
338	if (defined $whitelist) {	8✔
339	@okdomains = split(/ /, $whitelist);	8✔
340	}
341	my $host = Mojo::URL->new($url)->host;	8✔
342	unless (@okdomains) {	8✔
343	return (2, $host);	×
344	}
345	my $ok = 0;	8✔
346	for my $okdomain (@okdomains) {	8✔
347	my $quoted = qr/$okdomain/;	8✔
348	$ok = 1 if ($host =~ /${quoted}$/);	8✔
349	}
350	if ($ok) {	8✔
351	return ();	6✔
352	}
353	else {
354	return (1, $host);	2✔
355	}
356	}
357
358	sub check_download_whitelist {
359	# Passed the params hash ref for a job and the download_domains
360	# whitelist read from openqa.ini. Checks that all params ending
361	# in _URL (i.e. requesting asset download) specify URLs that are
362	# whitelisted. It's provided here so that we can run the check
363	# twice, once to return immediately and conveniently from the Iso
364	# controller, once again directly in the Gru asset download sub
365	# just in case someone somehow manages to bypass the API and
366	# create a gru task directly. On failure, returns an array of 4
367	# items: the first is 1 if there was a whitelist at all or 2 if
368	# there was not, the second is the name of the param for which the
369	# check failed, the third is the URL, and the fourth is the host.
370	# On success, returns an empty array.
371
372	my ($params, $whitelist) = @_;	11✔
373	my @okdomains;	11✔
374	if (defined $whitelist) {	11✔
375	@okdomains = split(/ /, $whitelist);	8✔
376	}
377	for my $param (keys %$params) {	11✔
378	next unless ($param =~ /_URL$/);	51✔
379	my $url = $$params{$param};	8✔
380	my @check = check_download_url($url, $whitelist);	8✔
381	next unless (@check);	8✔
382	# if we get here, we got a failure
383	return ($check[0], $param, $url, $check[1]);	2✔
384	}
385	# empty list signals caller that check passed
386	return ();	9✔
387	}
388
389	1;
390	# vim: set sw=4 et:

os-autoinst / openQA / 2226

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous