From 36b4898e2d6100d9bf1f40a05c6a02bd94ccf1a7 Mon Sep 17 00:00:00 2001 From: Mike Benowitz Date: Tue, 30 Apr 2019 10:43:26 -0400 Subject: [PATCH 1/5] Replace deprecated yaml loader Replaces the deprecated pyyaml `load` method with the `full_load` method, which prevents arbitrary code execution. Includes a test suite for the `read` helper method. --- aws_lambda/aws_lambda.py | 2 +- tests/unit/test_readHelper.py | 41 +++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 tests/unit/test_readHelper.py diff --git a/aws_lambda/aws_lambda.py b/aws_lambda/aws_lambda.py index f4c184d..cc69209 100755 --- a/aws_lambda/aws_lambda.py +++ b/aws_lambda/aws_lambda.py @@ -752,7 +752,7 @@ def get_concurrency(cfg): def read_cfg(path_to_config_file, profile_name): - cfg = read(path_to_config_file, loader=yaml.load) + cfg = read(path_to_config_file, loader=yaml.full_load) if profile_name is not None: cfg['profile'] = profile_name elif 'AWS_PROFILE' in os.environ: diff --git a/tests/unit/test_readHelper.py b/tests/unit/test_readHelper.py new file mode 100644 index 0000000..a8080e5 --- /dev/null +++ b/tests/unit/test_readHelper.py @@ -0,0 +1,41 @@ +import os +import unittest +import yaml +from yaml import YAMLLoadWarning +from aws_lambda.helpers import read + +class TestReadHelper(unittest.TestCase): + + TEST_FILE = 'readTmp.txt' + + def setUp(self): + with open(TestReadHelper.TEST_FILE, 'w') as tmp_file: + tmp_file.write('testYaml: testing') + + def tearDown(self): + os.remove(TestReadHelper.TEST_FILE) + + def test_read_no_loader_non_binary(self): + fileContents = read(TestReadHelper.TEST_FILE) + self.assertEqual(fileContents, 'testYaml: testing') + + def test_read_yaml_loader_non_binary(self): + testYaml = read(TestReadHelper.TEST_FILE, loader=yaml.full_load) + self.assertEqual(testYaml['testYaml'], 'testing') + + def test_read_no_loader_binary_mode(self): + fileContents = read(TestReadHelper.TEST_FILE, binary_file=True) + self.assertEqual(fileContents, b'testYaml: testing') + + def test_read_yaml_loader_binary_mode(self): + testYaml = read( + TestReadHelper.TEST_FILE, + loader=yaml.full_load, + binary_file=True + ) + self.assertEqual(testYaml['testYaml'], 'testing') + + def test_read_yaml_old_load_warns(self): + with self.assertWarns(YAMLLoadWarning): + testYaml = read(TestReadHelper.TEST_FILE, loader=yaml.load) + self.assertEqual(testYaml['testYaml'], 'testing') \ No newline at end of file From c6e1774c8c8d9b41509e183df2177f32427274df Mon Sep 17 00:00:00 2001 From: Mike Benowitz Date: Tue, 30 Apr 2019 10:46:03 -0400 Subject: [PATCH 2/5] Fix second/millisecond conversion issue in test case The test for the `get_remaining_time_in_millis` method was evaluating the output against a count in seconds, not milliseconds. This corrects the issue to allow the test suite to pass --- tests/unit/test_LambdaContext.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/unit/test_LambdaContext.py b/tests/unit/test_LambdaContext.py index 242174d..7a14e5a 100644 --- a/tests/unit/test_LambdaContext.py +++ b/tests/unit/test_LambdaContext.py @@ -5,9 +5,9 @@ class TestLambdaContext(unittest.TestCase): def test_get_remaining_time_in_millis(self): - context = LambdaContext('function_name',2000) + context = LambdaContext('function_name', 2000) time.sleep(.5) - self.assertTrue(context.get_remaining_time_in_millis() < 2000) + self.assertTrue(context.get_remaining_time_in_millis() < 2000000) if __name__ == '__main__': From dcd19650f60c53e5d7803ad15f4458e55997d1f2 Mon Sep 17 00:00:00 2001 From: Mike Benowitz Date: Tue, 30 Apr 2019 11:09:21 -0400 Subject: [PATCH 3/5] Bump version of pytest for compatability with pytest-cov --- tests/dev_requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/dev_requirements.txt b/tests/dev_requirements.txt index aa719a7..25e724b 100644 --- a/tests/dev_requirements.txt +++ b/tests/dev_requirements.txt @@ -1,5 +1,5 @@ bumpversion==0.5.3 pre-commit==0.15.0 -pytest +pytest>=3.6 pytest-cov flake8 From bb72087c0aad1f7b84e3fd5143ca3dd8e2a79170 Mon Sep 17 00:00:00 2001 From: Mike Benowitz Date: Tue, 30 Apr 2019 11:14:44 -0400 Subject: [PATCH 4/5] Remove python2.6 from travis AWS only supports python2.7+ (technically only 2.7 & 3.6). Additionally PyYAML does not support 2.6 which will cause failures in any case. --- .travis.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 81a8e34..97cc480 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,5 @@ language: python python: - - "2.6" - "2.7" - "3.3" - "3.4" From 81044ad2492084af64b71be5a6c1172ca289974b Mon Sep 17 00:00:00 2001 From: Mike Benowitz Date: Tue, 30 Apr 2019 11:26:54 -0400 Subject: [PATCH 5/5] Remove test incompatible with 2.7 --- tests/unit/test_readHelper.py | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/tests/unit/test_readHelper.py b/tests/unit/test_readHelper.py index a8080e5..3ad0c68 100644 --- a/tests/unit/test_readHelper.py +++ b/tests/unit/test_readHelper.py @@ -1,9 +1,9 @@ import os import unittest import yaml -from yaml import YAMLLoadWarning from aws_lambda.helpers import read + class TestReadHelper(unittest.TestCase): TEST_FILE = 'readTmp.txt' @@ -11,22 +11,22 @@ class TestReadHelper(unittest.TestCase): def setUp(self): with open(TestReadHelper.TEST_FILE, 'w') as tmp_file: tmp_file.write('testYaml: testing') - + def tearDown(self): os.remove(TestReadHelper.TEST_FILE) - + def test_read_no_loader_non_binary(self): fileContents = read(TestReadHelper.TEST_FILE) self.assertEqual(fileContents, 'testYaml: testing') - + def test_read_yaml_loader_non_binary(self): testYaml = read(TestReadHelper.TEST_FILE, loader=yaml.full_load) self.assertEqual(testYaml['testYaml'], 'testing') - + def test_read_no_loader_binary_mode(self): fileContents = read(TestReadHelper.TEST_FILE, binary_file=True) self.assertEqual(fileContents, b'testYaml: testing') - + def test_read_yaml_loader_binary_mode(self): testYaml = read( TestReadHelper.TEST_FILE, @@ -34,8 +34,3 @@ def test_read_yaml_loader_binary_mode(self): binary_file=True ) self.assertEqual(testYaml['testYaml'], 'testing') - - def test_read_yaml_old_load_warns(self): - with self.assertWarns(YAMLLoadWarning): - testYaml = read(TestReadHelper.TEST_FILE, loader=yaml.load) - self.assertEqual(testYaml['testYaml'], 'testing') \ No newline at end of file