thumbor / remotecv / 39876288252

94%

push

github

Refuse pyres jobs whose class is not DetectTask (#117)

pyres resolves the "class" field of every payload with __import__ and then
calls perform(*args) on whatever it finds, so anyone who can push to the
Detect queue in Redis chooses which module the worker imports and which
callable it runs. The worker only ever expects remotecv.pyres_tasks.DetectTask
on that queue, so there is no reason to let any other class through.

UniqueWorker.before_process now raises ValueError for any class outside a
fixed allowlist, after removing the unique key so a legitimate re-enqueue of
the same image is not blocked. pyres catches the exception, records the job
on resque:failed and moves on, which is the same path a crashing job takes
today. This does not change who can reach Redis, so the SECURITY.md advice
to restrict access to it still stands; it only closes the arbitrary-import
path through this worker.

4 of 4 new or added lines in 1 file covered. (100.0%)

482 of 571 relevant lines covered (84.41%)

4.22 hits per line