Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/security vulnerability #5692

Draft
wants to merge 10 commits into
base: main
Choose a base branch
from

Conversation

ince-dbt
Copy link
Contributor

@ince-dbt ince-dbt commented Oct 10, 2024

Description of change

This PR aims to fix a number of alerts recently flags by codescanning happen here

As per recommendation, when handling errors or exceptions in a secure system, it is crucial to provide generic messages to users rather than exposing detailed technical information. This approach is backed by various security standards and best practices (such as OWASP, ISO/IEC 27001, NIST, and PCI DSS) to prevent potential attackers from gaining insights into the internal workings of a system.

Checklist

  • Has this branch been rebased on top of the current main branch?

    Explanation

    The branch should not be stale or have conflicts at the time reviews are requested.

  • Is the CircleCI build passing?

General points

Other things to check

  • Make sure fixtures/test_data.yaml is maintained when updating models
  • Consider the admin site when making changes to models
  • Use select-/prefetch-related field lists in views and search apps, and update them when fields are added
  • Make sure the README is updated e.g. when adding new environment variables

See docs/CONTRIBUTING.md for more guidelines.

@ince-dbt ince-dbt requested a review from a team as a code owner October 10, 2024 12:21
@ince-dbt ince-dbt force-pushed the Fix/security-vulnerability-code-scanning branch from 090afc3 to 9788049 Compare October 10, 2024 12:58
Copy link

codecov bot commented Oct 10, 2024

Codecov Report

Attention: Patch coverage is 76.92308% with 6 lines in your changes missing coverage. Please review.

Project coverage is 96.34%. Comparing base (92b6f22) to head (7b64d54).
Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
datahub/dnb_api/views.py 80.95% 4 Missing ⚠️
datahub/dnb_api/utils.py 0.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #5692      +/-   ##
==========================================
- Coverage   96.36%   96.34%   -0.02%     
==========================================
  Files        1010     1010              
  Lines       23954    23966      +12     
  Branches     2155     2155              
==========================================
+ Hits        23084    23091       +7     
- Misses        703      707       +4     
- Partials      167      168       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@ince-dbt ince-dbt force-pushed the Fix/security-vulnerability-code-scanning branch from 9788049 to 7b64d54 Compare October 10, 2024 13:20
@ince-dbt ince-dbt changed the title Fix/security vulnerability code scanning Fix/security vulnerability Oct 10, 2024
@baarkerlounger
Copy link
Contributor

Can you add some tests to check that the detailed error message is still being logged correctly (as well, as the generic exceptions you have now)?

@ince-dbt
Copy link
Contributor Author

Can you add some tests to check that the detailed error message is still being logged correctly (as well, as the generic exceptions you have now)?

If you look at the original code, there was no error loggin at all. So, I was adding it for the purpose of help us pinpoint problems more effectively if they occur later

@baarkerlounger
Copy link
Contributor

@ince-dbt yep I realise the logging is new, but would be good to have tests for it

@ince-dbt ince-dbt marked this pull request as draft November 11, 2024 14:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants