matthew/sonic-buildimage
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
20f47bb5ac
sonic-buildimage/platform/broadcom/sonic-platform-modules-ragile/ra-b6910-64c
History
Mai Bui 95bb7f3b78
[device/ragile] Mitigation for security vulnerability (#11744) 
Signed-off-by: maipbui <maibui@microsoft.com>
#### Why I did it
The [xml.etree.ElementTree](https://docs.python.org/3/library/xml.etree.elementtree.html#module-xml.etree.ElementTree) module is not secure against maliciously constructed data.
`os` - not secure against maliciously constructed input and dangerous if used to evaluate dynamic content
`subprocess.getstatusoutput` is dangerous because include shell=True in the implementation
#### How I did it
Remove xml. Use [lxml](https://pypi.org/project/lxml/) XML parsers package that prevent potentially malicious operation.
Replace `os` by `subprocess`
Use command as an array instead of string
Use `getstatusoutput_noshell` in `sonic_py_common` lib
2022-11-29 11:54:37 -05:00
..
config [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
modules/driver [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
scripts [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
sonic_platform [device/ragile] Mitigation for security vulnerability (#11744) 2022-11-29 11:54:37 -05:00
systemd [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
LICENSE [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
MAINTAINERS [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
Makefile [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
README.md [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00
setup.py [platform/ragile] support ra-b6910-64c (#7950) 2021-09-09 10:49:37 -07:00

README.md

Device drivers for support of ragile platform for the SONiC project