OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos

[dobsonj]

Ignore these two errors. boilerplate.py is only used to update the copyright headers, or to verify the headers during make verify. In either case, it does not grant the caller access to files that they would not already have access to.

 ✗ [Medium] Path Traversal
   ID: e8346a4e-270e-4133-bb34-05e63d5712d6 
   Path: hack/boilerplate/boilerplate.py, line 57 
   Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
 ✗ [Medium] Path Traversal
   ID: bd89f292-215a-4991-a680-cc7aeb777560 
   Path: hack/boilerplate/boilerplate.py, line 173 
   Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-azure-disk-csi-driver-master-security/1745954191009910784

/cc @openshift/storage

[openshift-ci-robot]

@dobsonj: This pull request references Jira Issue OCPBUGS-27242, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Ignore these two errors. boilerplate.py is only used to update the copyright headers, or to verify the headers during make verify. In either case, it does not grant the caller access to files that they would not already have access to.

✗ [Medium] Path Traversal
  ID: e8346a4e-270e-4133-bb34-05e63d5712d6 
  Path: hack/boilerplate/boilerplate.py, line 57 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: bd89f292-215a-4991-a680-cc7aeb777560 
  Path: hack/boilerplate/boilerplate.py, line 173 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-azure-disk-csi-driver-master-security/1745954191009910784

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@dobsonj: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Ignore these two errors. boilerplate.py is only used to update the copyright headers, or to verify the headers during make verify. In either case, it does not grant the caller access to files that they would not already have access to.

✗ [Medium] Path Traversal
  ID: e8346a4e-270e-4133-bb34-05e63d5712d6 
  Path: hack/boilerplate/boilerplate.py, line 57 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: bd89f292-215a-4991-a680-cc7aeb777560 
  Path: hack/boilerplate/boilerplate.py, line 173 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-azure-disk-csi-driver-master-security/1745954191009910784

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dobsonj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jsafrane]

/lgtm

[jsafrane]

/retest

[openshift-ci]

@dobsonj: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@dobsonj: Jira Issue OCPBUGS-27242: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

• openshift/vmware-vsphere-csi-driver-operator#213 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-27242 has not been moved to the MODIFIED state.

Details

In response to this:

Ignore these two errors. boilerplate.py is only used to update the copyright headers, or to verify the headers during make verify. In either case, it does not grant the caller access to files that they would not already have access to.

✗ [Medium] Path Traversal
  ID: e8346a4e-270e-4133-bb34-05e63d5712d6 
  Path: hack/boilerplate/boilerplate.py, line 57 
  Info: Unsanitized input from a command line argument flows into open, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
✗ [Medium] Path Traversal
  ID: bd89f292-215a-4991-a680-cc7aeb777560 
  Path: hack/boilerplate/boilerplate.py, line 173 
  Info: Unsanitized input from a command line argument flows into os.walk, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-azure-disk-csi-driver-master-security/1745954191009910784

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-azure-disk-csi-driver-container-v4.16.0-202401191549.p0.ge5c4b2a.assembly.stream for distgit ose-azure-disk-csi-driver.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-01-21-092529