Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using a relative path for GIT_WORKING_PATH value with 'git' backend module creates unwanted subdirectories, returns 500 #39

Open
dev-dull opened this issue Jan 22, 2019 · 2 comments

Comments

@dev-dull
Copy link
Owner

dev-dull commented Jan 22, 2019

Setting GIT_WORKING_PATH to a relative path (e.g. GIT_WORKING_PATH: data) for the git backend module creates unwanted subdirectories and results in PyTerraBackTYL returning a 500 error code during a terraform apply/plan.

General reminder to always test using both relative and full paths.

Workaround:
Use the full path (e.g. /opt/pyterrabacktyl/data)

@dev-dull
Copy link
Owner Author

dev-dull commented Apr 27, 2019

I was unable to replicate this issue. Further investigation is needed, but it appears that during training, a user was hitting the '/' endpoint without 'env=VALUE' set in the URL which causes the Git backend module to default to the 'master' branch. The apparent symptoms and workaround would have been the result of timing.

If the above is confirmed as the issue:

  • git_backend.py should raise an exception instead of defaulting to 'master'
  • The function get gets and sets the environment from the URL should raise an exception.
  • a new issue should be opened to validate the user-agent string against a user-configurable list of accepted strings.

@dev-dull
Copy link
Owner Author

dev-dull commented May 6, 2019

2019-04-26 22:42:11,948 - werkzeug - ERROR - 192.168.xxx.xxx - - [26/Apr/2019 22:42:11] code 400, message Bad request syntax ('HELP')

An in-house security scanning platform was hitting arbitrary endpoints causing the Git backend to default to the 'master' branch; the above (from Apr. 27th) is confirmed and the fixes in the bulleted list should be made.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant