github-advanced-security[bot] commented on code in PR #76023:
URL: https://github.com/apache/airflow/pull/76023#discussion_r4422320799
##########
dev/breeze/tests/test_mirror_base_images.py:
##########
@@ -27,7 +28,41 @@
get_latest_hardened_python_patchlevel,
mirror_base_images,
)
-from airflow_breeze.global_constants import
ALL_PYTHON_VERSION_TO_PATCHLEVEL_VERSION
+from airflow_breeze.global_constants import (
+ ALL_PYTHON_VERSION_TO_PATCHLEVEL_VERSION,
+ HARDENED_PYTHON_IMAGE_DIGESTS,
+)
+
+MIRROR = "ghcr.io/apache/airflow/base/python"
+PINNED_TAG = f"{ALL_PYTHON_VERSION_TO_PATCHLEVEL_VERSION['3.14']}-debian13-dev"
+PINNED_DIGEST = HARDENED_PYTHON_IMAGE_DIGESTS[PINNED_TAG]
+NEW_DIGEST = "sha256:" + "ab" * 32
+
+
+class FakeRegistry:
+ """Answers run_command for imagetools, moving each mirrored tag to the
digest given for it."""
+
+ def __init__(self, digests_after_copy: dict[str, str]):
+ self.digests: dict[str, str] = {}
+ self.digests_after_copy = digests_after_copy
+ self.copies: list[tuple[str, list[str]]] = []
+
+ def __call__(self, cmd, **kwargs):
+ if cmd[3] == "inspect":
+ digest = self.digests.get(cmd[4])
+ stdout = json.dumps({"digest": digest}) if digest else ""
+ return CompletedProcess(args=cmd, returncode=0 if digest else 1,
stdout=stdout)
+ targets = [cmd[i + 1] for i, arg in enumerate(cmd) if arg == "--tag"]
+ self.copies.append((cmd[-1], targets))
+ for target in targets:
+ tag = target.split(":", 1)[1]
+ if tag in self.digests_after_copy:
+ self.digests[target] = self.digests_after_copy[tag]
+ return CompletedProcess(args=cmd, returncode=0)
+
+ @property
+ def sources(self) -> list[str]:
+ return [source for source, _ in self.copies if
source.startswith("dhi.io/")]
Review Comment:
## CodeQL / Incomplete URL substring sanitization
The string [dhi.io/](1) may be at an arbitrary position in the sanitized URL.
[Show more
details](https://github.com/apache/airflow/security/code-scanning/698)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
