github-advanced-security[bot] commented on code in PR #632:
URL:
https://github.com/apache/hugegraph-toolchain/pull/632#discussion_r3564881122
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/load/FileUploadController.java:
##########
@@ -293,19 +307,29 @@
log.debug("File content type: {}", file.getContentType());
String format = FilenameUtils.getExtension(fileName);
- List<String> formatWhiteList = this.config.get(
- HubbleOptions.UPLOAD_FILE_FORMAT_LIST);
- Ex.check(formatWhiteList.contains(format),
+ Ex.check(StringUtils.isNotBlank(format),
"load.upload.file.format.unsupported");
+ List<String> formatWhiteList = this.config.get(
+ HubbleOptions.UPLOAD_FILE_FORMAT_LIST);
+ String normalizedFormat = format.toLowerCase(Locale.ROOT);
+ boolean supported = formatWhiteList != null &&
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/77)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/load/FileMappingService.java:
##########
@@ -202,7 +206,18 @@
File newFile = new File(dir.getPath() + ".all");
File destFile = new File(dir.getPath());
+ if (newFile.exists()) {
+ try {
+ FileUtils.forceDelete(newFile);
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/90)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/auth/UserService.java:
##########
@@ -0,0 +1,545 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.hugegraph.service.auth;
+
+import java.io.File;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.apache.hugegraph.common.Constant;
+import org.apache.hugegraph.common.Response;
+import org.apache.hugegraph.structure.auth.Login;
+import org.apache.hugegraph.options.HubbleOptions;
+import lombok.extern.log4j.Log4j2;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import org.apache.hugegraph.config.HugeConfig;
+import org.apache.hugegraph.driver.AuthManager;
+import org.apache.hugegraph.driver.HugeClient;
+import org.apache.hugegraph.entity.auth.UserEntity;
+import org.apache.hugegraph.exception.InternalException;
+import org.apache.hugegraph.structure.auth.User;
+import org.apache.hugegraph.util.HubbleUtil;
+import org.apache.hugegraph.util.PageUtil;
+
+import com.csvreader.CsvReader;
+
+import org.springframework.web.multipart.MultipartFile;
+
+@Log4j2
+@Service
+public class UserService extends AuthService {
+
+ public static final String CREATE_SUCCESS = "successfully created";
+
+ //@Autowired
+ //BelongService belongService;
+
+ @Autowired
+ ManagerService managerService;
+
+ @Autowired
+ private HugeConfig config;
+
+ private boolean isPdEnabled() {
+ return config.get(HubbleOptions.PD_ENABLED);
+ }
+
+ public List<UserEntity> listUsers(HugeClient hugeClient) {
+ AuthManager auth = hugeClient.auth();
+
+ List<User> users = auth.listUsers();
+ List<UserEntity> ues = new ArrayList<>(users.size());
+ Map<String, Integer> countMap = new HashMap<>();
+ Map<String, List<String>> spaceMap = new HashMap<>();
+ users.forEach(u -> {
+ UserEntity ue = convert(hugeClient, u);
+ if (isPdEnabled()) {
+ ue.setSuperadmin(isSuperAdmin(hugeClient, ue.getId()));
+ } else {
+ ue.setSuperadmin(false);
+ }
+ ues.add(ue);
+ });
+ if (isPdEnabled()) {
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ spaceMap = HubbleUtil.uncheckedCast(listMap.get(0));
+ countMap = HubbleUtil.uncheckedCast(listMap.get(1));
+ for (UserEntity user : ues) {
+ user.setSpacenum(countMap.get(user.getName()));
+ user.setAdminSpaces(spaceMap.get(user.getName()));
+ }
+ }
+
+ return ues;
+ }
+
+ public UserEntity getUser(HugeClient client, String name) {
+ return convert(client, client.auth().getUserByName(name));
+ }
+
+ public Object queryPage(HugeClient hugeClient, String query,
+ int pageNo, int pageSize) {
+ AuthManager auth = hugeClient.auth();
+ Map<String, Integer> countMap = new HashMap<>();
+ Map<String, List<String>> spaceMap = new HashMap<>();
+
+ List<UserEntity> results =
+ hugeClient.auth().listUsers().stream()
+ .filter((u) -> u.name().contains(query) ||
+ u.nickname() != null &&
u.nickname().contains(query))
+ .sorted(Comparator.comparing(User::name))
+ .map((u) -> {
+ UserEntity ue = convert(hugeClient, u);
+ return ue;
+ }).collect(Collectors.toList());
+
+ if (isPdEnabled()) {
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ spaceMap = HubbleUtil.uncheckedCast(listMap.get(0));
+ countMap = HubbleUtil.uncheckedCast(listMap.get(1));
+ for (UserEntity user : results) {
+ user.setSpacenum(countMap.get(user.getName()));
+ user.setAdminSpaces(spaceMap.get(user.getName()));
+ user.setSuperadmin(isSuperAdmin(hugeClient, user.getId()));
+ }
+ }
+ return PageUtil.page(results, pageNo, pageSize);
+ }
+
+ public UserEntity get(HugeClient hugeClient, String userId) {
+ AuthManager auth = hugeClient.auth();
+ User user = auth.getUser(userId);
+ if (user == null) {
+ throw new InternalException("auth.user.get.%s Not Exits",
+ userId);
+ }
+ UserEntity userEntity = convert(hugeClient, user);
+ if (isPdEnabled()) {
+ userEntity.setSuperadmin(isSuperAdmin(hugeClient,
userEntity.getId()));
+ List<String> spaces = hugeClient.graphSpace().listGraphSpace();
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ Map<String, List<String>> spaceMap =
+ HubbleUtil.uncheckedCast(listMap.get(0));
+ List<String> adminSpaces = spaceMap.get(userId);
+ List<String> resSpaces = new ArrayList<>();
+ for (String space : spaces) {
+ if (hugeClient.graphSpace().checkDefaultRole(space, userId,
"analyst")) {
+ resSpaces.add(space);
+ }
+ }
+ resSpaces.addAll(adminSpaces);
+ userEntity.setAdminSpaces(adminSpaces);
+ userEntity.setSpacenum(adminSpaces.size());
+ userEntity.setResSpaces(resSpaces);
+ } else {
+ userEntity.setSuperadmin(false);
+ userEntity.setAdminSpaces(new ArrayList<>());
+ userEntity.setSpacenum(0);
+ userEntity.setResSpaces(new ArrayList<>());
+ }
+ return userEntity;
+ }
+
+ public UserEntity getpersonal(HugeClient hugeClient, String username) {
+ AuthManager auth = hugeClient.auth();
+ User user = auth.getUserByName(username);
+ if (user == null) {
+ throw new InternalException("auth.user.get.%s Not Exits",
+ username);
+ }
+ UserEntity userEntity = convert(hugeClient, user);
+ if (isPdEnabled()) {
+ userEntity.setSuperadmin(isSuperAdmin(hugeClient));
+ List<String> adminSpaces = new ArrayList<>();
+ List<String> resSpaces = new ArrayList<>();
+ List<String> spaces = hugeClient.graphSpace().listGraphSpace();
+ for (String space : spaces) {
+ if (hugeClient.auth().isSpaceAdmin(space)) {
+ adminSpaces.add(space);
+ }
+ if (hugeClient.auth().isSpaceAdmin(space) ||
+ hugeClient.auth().checkDefaultRole(space, "analyst")) {
+ resSpaces.add(space);
+ }
+ }
+ userEntity.setAdminSpaces(adminSpaces);
+ userEntity.setSpacenum(adminSpaces.size());
+ userEntity.setResSpaces(resSpaces);
+ } else {
+ userEntity.setSuperadmin(false);
+ userEntity.setAdminSpaces(new ArrayList<>());
+ userEntity.setSpacenum(0);
+ userEntity.setResSpaces(new ArrayList<>());
+ }
+ return userEntity;
+ }
+
+ public void add(HugeClient client, UserEntity ue) {
+ User user = new User();
+ user.name(ue.getName());
+ user.password(ue.getPassword());
+ user.phone(ue.getPhone());
+ user.email(ue.getEmail());
+ user.avatar(ue.getAvatar());
+ user.description(ue.getDescription());
+ user.nickname(ue.getNickname());
+
+ User newUser = client.auth().createUser(user);
+ if (ue.getAdminSpaces() != null) {
+ for (String graphspace : ue.getAdminSpaces()) {
+ client.auth().addSpaceAdmin(ue.getName(), graphspace);
+ }
+ }
+
+ if (newUser != null && ue.isSuperadmin()) {
+ // add superadmin
+ client.auth().addSuperAdmin(newUser.id().toString());
+ }
+ }
+
+ public String addbatch(HugeClient client, MultipartFile csvFile) {
+ File file = multipartFileToFile(csvFile);
+ try {
+ Map<String, Object> csv = readCsvByCsvReader(file);
+ List<Map<String, String>> createBatchBody =
+ HubbleUtil.uncheckedCast(csv.get("data"));
+ Map<String, List<Map<String, String>>> result =
+ client.auth().createBatch(createBatchBody);
+ List<Map<String, String>> resultList = result.get("result");
+ List<String> failedList = new ArrayList<>(createBatchBody.size());
+ for (Map<String, String> entry : resultList) {
+ if (!CREATE_SUCCESS.equals(entry.get("result"))) {
+ failedList.add(entry.get("user_name"));
+ }
+ }
+ if (!failedList.isEmpty()) {
+ throw new InternalException("auth.user.batch-create.failed",
+ failedList);
+ }
+ return "success";
+ } finally {
+ if (!file.delete()) {
+ log.warn("Failed to delete temporary user import file '{}'; " +
+ "it will be removed by the operating system", file);
+ }
+ }
+ }
+
+ public File multipartFileToFile(MultipartFile multiFile) {
+ File file = null;
+ try {
+ String originalName = multiFile.getOriginalFilename();
+ String suffix = ".tmp";
+ if (originalName != null) {
+ int dot = originalName.lastIndexOf('.');
+ String candidate = dot >= 0 ? originalName.substring(dot) : "";
+ if (candidate.matches("\\.[A-Za-z0-9]{1,16}")) {
+ suffix = candidate;
+ }
+ }
+ file = File.createTempFile("hubble-user-import-", suffix);
+ multiFile.transferTo(file);
+ return file;
+ } catch (Exception e) {
+ log.error("Failed to create a temporary file for user import", e);
+ if (file != null && file.exists() && !file.delete()) {
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
This path depends on a [user-provided value](3).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/88)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/auth/UserService.java:
##########
@@ -0,0 +1,545 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.hugegraph.service.auth;
+
+import java.io.File;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.apache.hugegraph.common.Constant;
+import org.apache.hugegraph.common.Response;
+import org.apache.hugegraph.structure.auth.Login;
+import org.apache.hugegraph.options.HubbleOptions;
+import lombok.extern.log4j.Log4j2;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import org.apache.hugegraph.config.HugeConfig;
+import org.apache.hugegraph.driver.AuthManager;
+import org.apache.hugegraph.driver.HugeClient;
+import org.apache.hugegraph.entity.auth.UserEntity;
+import org.apache.hugegraph.exception.InternalException;
+import org.apache.hugegraph.structure.auth.User;
+import org.apache.hugegraph.util.HubbleUtil;
+import org.apache.hugegraph.util.PageUtil;
+
+import com.csvreader.CsvReader;
+
+import org.springframework.web.multipart.MultipartFile;
+
+@Log4j2
+@Service
+public class UserService extends AuthService {
+
+ public static final String CREATE_SUCCESS = "successfully created";
+
+ //@Autowired
+ //BelongService belongService;
+
+ @Autowired
+ ManagerService managerService;
+
+ @Autowired
+ private HugeConfig config;
+
+ private boolean isPdEnabled() {
+ return config.get(HubbleOptions.PD_ENABLED);
+ }
+
+ public List<UserEntity> listUsers(HugeClient hugeClient) {
+ AuthManager auth = hugeClient.auth();
+
+ List<User> users = auth.listUsers();
+ List<UserEntity> ues = new ArrayList<>(users.size());
+ Map<String, Integer> countMap = new HashMap<>();
+ Map<String, List<String>> spaceMap = new HashMap<>();
+ users.forEach(u -> {
+ UserEntity ue = convert(hugeClient, u);
+ if (isPdEnabled()) {
+ ue.setSuperadmin(isSuperAdmin(hugeClient, ue.getId()));
+ } else {
+ ue.setSuperadmin(false);
+ }
+ ues.add(ue);
+ });
+ if (isPdEnabled()) {
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ spaceMap = HubbleUtil.uncheckedCast(listMap.get(0));
+ countMap = HubbleUtil.uncheckedCast(listMap.get(1));
+ for (UserEntity user : ues) {
+ user.setSpacenum(countMap.get(user.getName()));
+ user.setAdminSpaces(spaceMap.get(user.getName()));
+ }
+ }
+
+ return ues;
+ }
+
+ public UserEntity getUser(HugeClient client, String name) {
+ return convert(client, client.auth().getUserByName(name));
+ }
+
+ public Object queryPage(HugeClient hugeClient, String query,
+ int pageNo, int pageSize) {
+ AuthManager auth = hugeClient.auth();
+ Map<String, Integer> countMap = new HashMap<>();
+ Map<String, List<String>> spaceMap = new HashMap<>();
+
+ List<UserEntity> results =
+ hugeClient.auth().listUsers().stream()
+ .filter((u) -> u.name().contains(query) ||
+ u.nickname() != null &&
u.nickname().contains(query))
+ .sorted(Comparator.comparing(User::name))
+ .map((u) -> {
+ UserEntity ue = convert(hugeClient, u);
+ return ue;
+ }).collect(Collectors.toList());
+
+ if (isPdEnabled()) {
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ spaceMap = HubbleUtil.uncheckedCast(listMap.get(0));
+ countMap = HubbleUtil.uncheckedCast(listMap.get(1));
+ for (UserEntity user : results) {
+ user.setSpacenum(countMap.get(user.getName()));
+ user.setAdminSpaces(spaceMap.get(user.getName()));
+ user.setSuperadmin(isSuperAdmin(hugeClient, user.getId()));
+ }
+ }
+ return PageUtil.page(results, pageNo, pageSize);
+ }
+
+ public UserEntity get(HugeClient hugeClient, String userId) {
+ AuthManager auth = hugeClient.auth();
+ User user = auth.getUser(userId);
+ if (user == null) {
+ throw new InternalException("auth.user.get.%s Not Exits",
+ userId);
+ }
+ UserEntity userEntity = convert(hugeClient, user);
+ if (isPdEnabled()) {
+ userEntity.setSuperadmin(isSuperAdmin(hugeClient,
userEntity.getId()));
+ List<String> spaces = hugeClient.graphSpace().listGraphSpace();
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ Map<String, List<String>> spaceMap =
+ HubbleUtil.uncheckedCast(listMap.get(0));
+ List<String> adminSpaces = spaceMap.get(userId);
+ List<String> resSpaces = new ArrayList<>();
+ for (String space : spaces) {
+ if (hugeClient.graphSpace().checkDefaultRole(space, userId,
"analyst")) {
+ resSpaces.add(space);
+ }
+ }
+ resSpaces.addAll(adminSpaces);
+ userEntity.setAdminSpaces(adminSpaces);
+ userEntity.setSpacenum(adminSpaces.size());
+ userEntity.setResSpaces(resSpaces);
+ } else {
+ userEntity.setSuperadmin(false);
+ userEntity.setAdminSpaces(new ArrayList<>());
+ userEntity.setSpacenum(0);
+ userEntity.setResSpaces(new ArrayList<>());
+ }
+ return userEntity;
+ }
+
+ public UserEntity getpersonal(HugeClient hugeClient, String username) {
+ AuthManager auth = hugeClient.auth();
+ User user = auth.getUserByName(username);
+ if (user == null) {
+ throw new InternalException("auth.user.get.%s Not Exits",
+ username);
+ }
+ UserEntity userEntity = convert(hugeClient, user);
+ if (isPdEnabled()) {
+ userEntity.setSuperadmin(isSuperAdmin(hugeClient));
+ List<String> adminSpaces = new ArrayList<>();
+ List<String> resSpaces = new ArrayList<>();
+ List<String> spaces = hugeClient.graphSpace().listGraphSpace();
+ for (String space : spaces) {
+ if (hugeClient.auth().isSpaceAdmin(space)) {
+ adminSpaces.add(space);
+ }
+ if (hugeClient.auth().isSpaceAdmin(space) ||
+ hugeClient.auth().checkDefaultRole(space, "analyst")) {
+ resSpaces.add(space);
+ }
+ }
+ userEntity.setAdminSpaces(adminSpaces);
+ userEntity.setSpacenum(adminSpaces.size());
+ userEntity.setResSpaces(resSpaces);
+ } else {
+ userEntity.setSuperadmin(false);
+ userEntity.setAdminSpaces(new ArrayList<>());
+ userEntity.setSpacenum(0);
+ userEntity.setResSpaces(new ArrayList<>());
+ }
+ return userEntity;
+ }
+
+ public void add(HugeClient client, UserEntity ue) {
+ User user = new User();
+ user.name(ue.getName());
+ user.password(ue.getPassword());
+ user.phone(ue.getPhone());
+ user.email(ue.getEmail());
+ user.avatar(ue.getAvatar());
+ user.description(ue.getDescription());
+ user.nickname(ue.getNickname());
+
+ User newUser = client.auth().createUser(user);
+ if (ue.getAdminSpaces() != null) {
+ for (String graphspace : ue.getAdminSpaces()) {
+ client.auth().addSpaceAdmin(ue.getName(), graphspace);
+ }
+ }
+
+ if (newUser != null && ue.isSuperadmin()) {
+ // add superadmin
+ client.auth().addSuperAdmin(newUser.id().toString());
+ }
+ }
+
+ public String addbatch(HugeClient client, MultipartFile csvFile) {
+ File file = multipartFileToFile(csvFile);
+ try {
+ Map<String, Object> csv = readCsvByCsvReader(file);
+ List<Map<String, String>> createBatchBody =
+ HubbleUtil.uncheckedCast(csv.get("data"));
+ Map<String, List<Map<String, String>>> result =
+ client.auth().createBatch(createBatchBody);
+ List<Map<String, String>> resultList = result.get("result");
+ List<String> failedList = new ArrayList<>(createBatchBody.size());
+ for (Map<String, String> entry : resultList) {
+ if (!CREATE_SUCCESS.equals(entry.get("result"))) {
+ failedList.add(entry.get("user_name"));
+ }
+ }
+ if (!failedList.isEmpty()) {
+ throw new InternalException("auth.user.batch-create.failed",
+ failedList);
+ }
+ return "success";
+ } finally {
+ if (!file.delete()) {
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/86)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/load/FileUploadController.java:
##########
@@ -293,19 +307,29 @@
log.debug("File content type: {}", file.getContentType());
String format = FilenameUtils.getExtension(fileName);
- List<String> formatWhiteList = this.config.get(
- HubbleOptions.UPLOAD_FILE_FORMAT_LIST);
- Ex.check(formatWhiteList.contains(format),
+ Ex.check(StringUtils.isNotBlank(format),
"load.upload.file.format.unsupported");
+ List<String> formatWhiteList = this.config.get(
+ HubbleOptions.UPLOAD_FILE_FORMAT_LIST);
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/76)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/load/FileMappingService.java:
##########
@@ -202,7 +206,18 @@
File newFile = new File(dir.getPath() + ".all");
File destFile = new File(dir.getPath());
+ if (newFile.exists()) {
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/89)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/auth/UserService.java:
##########
@@ -0,0 +1,545 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.hugegraph.service.auth;
+
+import java.io.File;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.apache.hugegraph.common.Constant;
+import org.apache.hugegraph.common.Response;
+import org.apache.hugegraph.structure.auth.Login;
+import org.apache.hugegraph.options.HubbleOptions;
+import lombok.extern.log4j.Log4j2;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import org.apache.hugegraph.config.HugeConfig;
+import org.apache.hugegraph.driver.AuthManager;
+import org.apache.hugegraph.driver.HugeClient;
+import org.apache.hugegraph.entity.auth.UserEntity;
+import org.apache.hugegraph.exception.InternalException;
+import org.apache.hugegraph.structure.auth.User;
+import org.apache.hugegraph.util.HubbleUtil;
+import org.apache.hugegraph.util.PageUtil;
+
+import com.csvreader.CsvReader;
+
+import org.springframework.web.multipart.MultipartFile;
+
+@Log4j2
+@Service
+public class UserService extends AuthService {
+
+ public static final String CREATE_SUCCESS = "successfully created";
+
+ //@Autowired
+ //BelongService belongService;
+
+ @Autowired
+ ManagerService managerService;
+
+ @Autowired
+ private HugeConfig config;
+
+ private boolean isPdEnabled() {
+ return config.get(HubbleOptions.PD_ENABLED);
+ }
+
+ public List<UserEntity> listUsers(HugeClient hugeClient) {
+ AuthManager auth = hugeClient.auth();
+
+ List<User> users = auth.listUsers();
+ List<UserEntity> ues = new ArrayList<>(users.size());
+ Map<String, Integer> countMap = new HashMap<>();
+ Map<String, List<String>> spaceMap = new HashMap<>();
+ users.forEach(u -> {
+ UserEntity ue = convert(hugeClient, u);
+ if (isPdEnabled()) {
+ ue.setSuperadmin(isSuperAdmin(hugeClient, ue.getId()));
+ } else {
+ ue.setSuperadmin(false);
+ }
+ ues.add(ue);
+ });
+ if (isPdEnabled()) {
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ spaceMap = HubbleUtil.uncheckedCast(listMap.get(0));
+ countMap = HubbleUtil.uncheckedCast(listMap.get(1));
+ for (UserEntity user : ues) {
+ user.setSpacenum(countMap.get(user.getName()));
+ user.setAdminSpaces(spaceMap.get(user.getName()));
+ }
+ }
+
+ return ues;
+ }
+
+ public UserEntity getUser(HugeClient client, String name) {
+ return convert(client, client.auth().getUserByName(name));
+ }
+
+ public Object queryPage(HugeClient hugeClient, String query,
+ int pageNo, int pageSize) {
+ AuthManager auth = hugeClient.auth();
+ Map<String, Integer> countMap = new HashMap<>();
+ Map<String, List<String>> spaceMap = new HashMap<>();
+
+ List<UserEntity> results =
+ hugeClient.auth().listUsers().stream()
+ .filter((u) -> u.name().contains(query) ||
+ u.nickname() != null &&
u.nickname().contains(query))
+ .sorted(Comparator.comparing(User::name))
+ .map((u) -> {
+ UserEntity ue = convert(hugeClient, u);
+ return ue;
+ }).collect(Collectors.toList());
+
+ if (isPdEnabled()) {
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ spaceMap = HubbleUtil.uncheckedCast(listMap.get(0));
+ countMap = HubbleUtil.uncheckedCast(listMap.get(1));
+ for (UserEntity user : results) {
+ user.setSpacenum(countMap.get(user.getName()));
+ user.setAdminSpaces(spaceMap.get(user.getName()));
+ user.setSuperadmin(isSuperAdmin(hugeClient, user.getId()));
+ }
+ }
+ return PageUtil.page(results, pageNo, pageSize);
+ }
+
+ public UserEntity get(HugeClient hugeClient, String userId) {
+ AuthManager auth = hugeClient.auth();
+ User user = auth.getUser(userId);
+ if (user == null) {
+ throw new InternalException("auth.user.get.%s Not Exits",
+ userId);
+ }
+ UserEntity userEntity = convert(hugeClient, user);
+ if (isPdEnabled()) {
+ userEntity.setSuperadmin(isSuperAdmin(hugeClient,
userEntity.getId()));
+ List<String> spaces = hugeClient.graphSpace().listGraphSpace();
+ List<Object> listMap = getSpaceAndSpacenum(hugeClient);
+ Map<String, List<String>> spaceMap =
+ HubbleUtil.uncheckedCast(listMap.get(0));
+ List<String> adminSpaces = spaceMap.get(userId);
+ List<String> resSpaces = new ArrayList<>();
+ for (String space : spaces) {
+ if (hugeClient.graphSpace().checkDefaultRole(space, userId,
"analyst")) {
+ resSpaces.add(space);
+ }
+ }
+ resSpaces.addAll(adminSpaces);
+ userEntity.setAdminSpaces(adminSpaces);
+ userEntity.setSpacenum(adminSpaces.size());
+ userEntity.setResSpaces(resSpaces);
+ } else {
+ userEntity.setSuperadmin(false);
+ userEntity.setAdminSpaces(new ArrayList<>());
+ userEntity.setSpacenum(0);
+ userEntity.setResSpaces(new ArrayList<>());
+ }
+ return userEntity;
+ }
+
+ public UserEntity getpersonal(HugeClient hugeClient, String username) {
+ AuthManager auth = hugeClient.auth();
+ User user = auth.getUserByName(username);
+ if (user == null) {
+ throw new InternalException("auth.user.get.%s Not Exits",
+ username);
+ }
+ UserEntity userEntity = convert(hugeClient, user);
+ if (isPdEnabled()) {
+ userEntity.setSuperadmin(isSuperAdmin(hugeClient));
+ List<String> adminSpaces = new ArrayList<>();
+ List<String> resSpaces = new ArrayList<>();
+ List<String> spaces = hugeClient.graphSpace().listGraphSpace();
+ for (String space : spaces) {
+ if (hugeClient.auth().isSpaceAdmin(space)) {
+ adminSpaces.add(space);
+ }
+ if (hugeClient.auth().isSpaceAdmin(space) ||
+ hugeClient.auth().checkDefaultRole(space, "analyst")) {
+ resSpaces.add(space);
+ }
+ }
+ userEntity.setAdminSpaces(adminSpaces);
+ userEntity.setSpacenum(adminSpaces.size());
+ userEntity.setResSpaces(resSpaces);
+ } else {
+ userEntity.setSuperadmin(false);
+ userEntity.setAdminSpaces(new ArrayList<>());
+ userEntity.setSpacenum(0);
+ userEntity.setResSpaces(new ArrayList<>());
+ }
+ return userEntity;
+ }
+
+ public void add(HugeClient client, UserEntity ue) {
+ User user = new User();
+ user.name(ue.getName());
+ user.password(ue.getPassword());
+ user.phone(ue.getPhone());
+ user.email(ue.getEmail());
+ user.avatar(ue.getAvatar());
+ user.description(ue.getDescription());
+ user.nickname(ue.getNickname());
+
+ User newUser = client.auth().createUser(user);
+ if (ue.getAdminSpaces() != null) {
+ for (String graphspace : ue.getAdminSpaces()) {
+ client.auth().addSpaceAdmin(ue.getName(), graphspace);
+ }
+ }
+
+ if (newUser != null && ue.isSuperadmin()) {
+ // add superadmin
+ client.auth().addSuperAdmin(newUser.id().toString());
+ }
+ }
+
+ public String addbatch(HugeClient client, MultipartFile csvFile) {
+ File file = multipartFileToFile(csvFile);
+ try {
+ Map<String, Object> csv = readCsvByCsvReader(file);
+ List<Map<String, String>> createBatchBody =
+ HubbleUtil.uncheckedCast(csv.get("data"));
+ Map<String, List<Map<String, String>>> result =
+ client.auth().createBatch(createBatchBody);
+ List<Map<String, String>> resultList = result.get("result");
+ List<String> failedList = new ArrayList<>(createBatchBody.size());
+ for (Map<String, String> entry : resultList) {
+ if (!CREATE_SUCCESS.equals(entry.get("result"))) {
+ failedList.add(entry.get("user_name"));
+ }
+ }
+ if (!failedList.isEmpty()) {
+ throw new InternalException("auth.user.batch-create.failed",
+ failedList);
+ }
+ return "success";
+ } finally {
+ if (!file.delete()) {
+ log.warn("Failed to delete temporary user import file '{}'; " +
+ "it will be removed by the operating system", file);
+ }
+ }
+ }
+
+ public File multipartFileToFile(MultipartFile multiFile) {
+ File file = null;
+ try {
+ String originalName = multiFile.getOriginalFilename();
+ String suffix = ".tmp";
+ if (originalName != null) {
+ int dot = originalName.lastIndexOf('.');
+ String candidate = dot >= 0 ? originalName.substring(dot) : "";
+ if (candidate.matches("\\.[A-Za-z0-9]{1,16}")) {
+ suffix = candidate;
+ }
+ }
+ file = File.createTempFile("hubble-user-import-", suffix);
+ multiFile.transferTo(file);
+ return file;
+ } catch (Exception e) {
+ log.error("Failed to create a temporary file for user import", e);
+ if (file != null && file.exists() && !file.delete()) {
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
This path depends on a [user-provided value](3).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/87)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/service/load/FileMappingService.java:
##########
@@ -210,27 +225,28 @@
~ log.error("Failed to rename file from {} to {}",
~ partFiles[0], newFile, e);
~ throw new InternalException("load.upload.move-file.failed", e);
~ }
~ } else {
~ Arrays.sort(partFiles, (o1, o2) -> {
~ String file1Idx = StringUtils.substringAfterLast(o1.getName(),
~ "-");
~ String file2Idx = StringUtils.substringAfterLast(o2.getName(),
~ "-");
~ Integer idx1 = Integer.valueOf(file1Idx);
Integer idx2 = Integer.valueOf(file2Idx);
return idx1.compareTo(idx2);
});
- try (OutputStream os = new FileOutputStream(newFile, true)) {
+ try (OutputStream os = new FileOutputStream(newFile, false)) {
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/91)
##########
hugegraph-hubble/hubble-be/src/main/java/org/apache/hugegraph/controller/langchain/LangChainController.java:
##########
@@ -0,0 +1,771 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.hugegraph.controller.langchain;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
+import java.util.HashMap;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+import org.apache.hugegraph.controller.query.GremlinController;
+import org.apache.hugegraph.driver.SchemaManager;
+import org.apache.hugegraph.entity.query.GremlinQuery;
+import org.apache.hugegraph.entity.query.JsonView;
+import org.apache.hugegraph.service.query.QueryService;
+import org.apache.hugegraph.structure.schema.EdgeLabel;
+import org.apache.hugegraph.structure.schema.VertexLabel;
+import org.apache.hugegraph.config.ConfigOption;
+import org.apache.hugegraph.config.HugeConfig;
+import org.apache.hugegraph.options.HubbleOptions;
+import org.apache.hugegraph.util.Ex;
+import org.apache.hugegraph.util.JsonUtil;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.compress.utils.Lists;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.hugegraph.util.E;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import org.apache.hugegraph.common.Constant;
+import org.apache.hugegraph.controller.BaseController;
+import org.apache.hugegraph.driver.HugeClient;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import lombok.extern.log4j.Log4j2;
+
+/**
+ * langchain controller
+ */
+@Log4j2
+@RestController
+@RequestMapping(Constant.API_VERSION +
"graphspaces/{graphspace}/graphs/{graph}")
+public class LangChainController extends BaseController {
+
+ private static final String DEFAULT_PYTHON_FILE =
"langchaincode/excute_langchain.py";
+ private static final String DEFAULT_PYTHON_SCRIPT = "excute_langchain.py";
+
+ private static final String G_V = "g.v";
+ private static final String G_E = "g.e";
+
+ private static final String WENXIN_4_MODEL = "wenxin4";
+ private static final String GPT_4_MODEL = "gpt4";
+
+ private static final List<String> DEFAULT_MODEL =
Arrays.asList(WENXIN_4_MODEL, GPT_4_MODEL);
+
+ @Autowired
+ private QueryService queryService;
+
+ @Autowired
+ private HugeConfig config;
+
+ @PostMapping("langchain")
+ public Object langchain(@PathVariable("graphspace") String graphSpace,
+ @PathVariable("graph") String graph,
+ @RequestBody RequestLangChainParams
requestLangChainParams) {
+ E.checkNotNull(requestLangChainParams, "params must not be null");
+ log.info("LangChainController langchain params:{}");
+ this.checkParams(requestLangChainParams);
+ this.checkModelParams(requestLangChainParams);
+ this.checkUserParam(requestLangChainParams);
+
+ this.tryLogin(graphSpace, graph,
+ requestLangChainParams.userName,
requestLangChainParams.password);
+
+ return this.langChainQuery(graphSpace, graph, requestLangChainParams);
+ }
+
+ @PostMapping("langchain/hubble")
+ public Object langchainHubble(@PathVariable("graphspace") String
graphSpace,
+ @PathVariable("graph") String graph,
+ @RequestBody RequestLangChainParams
requestLangChainParams) {
+ E.checkNotNull(requestLangChainParams, "params must not be null");
+ log.info("LangChainController langchain request model:{} file:{}",
+ requestLangChainParams.model,
requestLangChainParams.fileName);
+ this.checkParams(requestLangChainParams);
+
+ return this.langChainQuery(graphSpace, graph, requestLangChainParams);
+ }
+
+ private ResponseLangChain langChainQuery(String graphSpace, String graph,
+ RequestLangChainParams
requestLangChainParams) {
+ HugeClient client = this.authClient(graphSpace, graph);
+ SchemaManager schemaManager = client.schema();
+ List<VertexLabel> vertexLabels = schemaManager.getVertexLabels();
+ List<EdgeLabel> edgeLabels = schemaManager.getEdgeLabels();
+ String schema = JsonUtil.toJson(this.getBigModelSchema(vertexLabels,
edgeLabels));
+ log.info("langchain schema:{}", schema);
+
+ String filePath = this.resolvePythonScriptPath(
+ requestLangChainParams.fileName);
+ log.info("LangChainController filePath:{}", filePath);
+
+ List<String> result =
+ this.excutePythonRuntime(requestLangChainParams.pythonPath,
+ filePath,
requestLangChainParams.query,
+ requestLangChainParams.openKey,
schema,
+ requestLangChainParams.model,
+ requestLangChainParams.ernieClientId,
+
requestLangChainParams.ernieClientSecret);
+ if (CollectionUtils.isEmpty(result)) {
+ return this.generateResponseLangChain(requestLangChainParams.query,
+ "LangChain not generate gremlin");
+ } else {
+ return this.generateResponseLangChain(requestLangChainParams.query,
+ result.get(result.size() - 1));
+ }
+ }
+
+ @PostMapping("langchain/schema")
+ public Object langchainSchema(@PathVariable("graphspace") String
graphSpace,
+ @PathVariable("graph") String graph,
+ @RequestBody RequestLangChainParams
requestLangChainParams) {
+ E.checkNotNull(requestLangChainParams, "params must not be null");
+ log.info("LangChainController langchain schema request username:{}",
+ requestLangChainParams.userName);
+ this.checkUserParam(requestLangChainParams);
+
+ this.tryLogin(graphSpace, graph,
+ requestLangChainParams.userName,
requestLangChainParams.password);
+
+ HugeClient client = this.authClient(graphSpace, graph);
+ SchemaManager schemaManager = client.schema();
+ List<VertexLabel> vertexLabels = schemaManager.getVertexLabels();
+ List<EdgeLabel> edgeLabels = schemaManager.getEdgeLabels();
+ HashMap<String, Object> schema = this.getBigModelSchema(vertexLabels,
edgeLabels);
+ return schema;
+ }
+
+ @PostMapping("gremlin")
+ public Object gremlin(@PathVariable("graphspace") String graphSpace,
+ @PathVariable("graph") String graph,
+ @RequestBody RequestLangChainParams
requestLangChainParams) {
+ E.checkNotNull(requestLangChainParams, "params must not be null");
+ GremlinQuery query = new GremlinQuery();
+ query.setContent(requestLangChainParams.query);
+ this.checkParamsValid(query);
+ this.checkUserParam(requestLangChainParams);
+
+ this.tryLogin(graphSpace, graph,
+ requestLangChainParams.userName,
requestLangChainParams.password);
+
+ try {
+ HugeClient client = this.authClient(graphSpace, graph);
+ JsonView result =
+ this.queryService.executeSingleGremlinQuery(client, query);
+ return result.getData();
+ } catch (Throwable e) {
+ throw e;
+ }
+ }
+
+ @PostMapping("langchain_no_schema")
+ public Object langchainNoSchema(@PathVariable("graphspace") String
graphSpace,
+ @PathVariable("graph") String graph,
+ @RequestBody RequestLangChainParams
requestLangChainParams) {
+ E.checkNotNull(requestLangChainParams, "params must not be null");
+ log.info("LangChainController langchain no schema request model:{}
file:{}",
+ requestLangChainParams.model,
requestLangChainParams.fileName);
+
+ this.checkParams(requestLangChainParams);
+ this.checkModelParams(requestLangChainParams);
+
+ String filePath = this.resolvePythonScriptPath(
+ requestLangChainParams.fileName);
+ log.info("LangChainController filePath:{}", filePath);
+
+ List<String> result =
+ this.excutePythonByProcessBuilder(
+ requestLangChainParams.pythonPath, filePath,
+ requestLangChainParams.query,
+ requestLangChainParams.openKey,
+ requestLangChainParams.graphSchema,
+ requestLangChainParams.model,
+ requestLangChainParams.ernieClientId,
+ requestLangChainParams.ernieClientSecret);
+ if (CollectionUtils.isEmpty(result)) {
+ return this.generateResponseLangChain(requestLangChainParams.query,
+ "LangChain not generate gremlin");
+ } else {
+ return this.generateResponseLangChain(requestLangChainParams.query,
+ result.get(result.size() - 1));
+ }
+ }
+
+ private void tryLogin(String graphSpace, String graph,
+ String username, String password) {
+ log.info("Attempting to login username:{}", username);
+
+ E.checkNotNull(username, "username cannot be null");
+ E.checkNotNull(password, "password cannot be null");
+ String token = this.getToken();
+ if (StringUtils.isNotEmpty(token)) {
+ log.info("Attempting to login token exist, username:{}", username);
+ return;
+ }
+ if (Objects.isNull(this.getToken())) {
+ log.error("Attempting to login failed, username:{}", username);
+ throw new IllegalStateException("login failed");
+ }
+ }
+
+ /**
+ *
+ * @param pythonPath
+ * @param pythonScriptPath
+ * @param query
+ * @param openKey
+ * @param graphSchema
+ * @return
+ */
+ private List<String> excutePythonRuntime(String pythonPath,
+ String pythonScriptPath,
+ String query,
+ String openKey,
+ String graphSchema,
+ String model,
+ String ernieClientId,
+ String ernieClientSecret) {
+ String[] args1 = this.getExcuteArgs(pythonPath, pythonScriptPath,
+ query, openKey, graphSchema,
+ model, ernieClientId,
+ ernieClientSecret);
+ return this.executePythonProcess(args1, model,
+ this.secretValues(openKey,
+ ernieClientSecret));
+ }
+
+ /**
+ * 使用ProcessBuilder执行python脚本
+ * @param pythonPath
+ * @param pythonScriptPath
+ * @param query
+ * @param openKey
+ * @param graphSchema
+ * @return
+ */
+ private List<String> excutePythonByProcessBuilder(String pythonPath,
+ String pythonScriptPath,
+ String query,
+ String openKey,
+ String graphSchema,
+ String model,
+ String ernieClientId,
+ String
ernieClientSecret) {
+ String[] args1 = this.getExcuteArgs(pythonPath, pythonScriptPath,
+ query, openKey, graphSchema,
+ model, ernieClientId,
+ ernieClientSecret);
+ return this.executePythonProcess(args1, model,
+ this.secretValues(openKey,
+ ernieClientSecret));
+ }
+
+ private String resolvePythonScriptPath(String fileName) {
+ E.checkArgument(StringUtils.isNotBlank(fileName),
+ "fileName must not be blank");
+ Path requested = Paths.get(fileName).normalize();
+ E.checkArgument(!requested.isAbsolute() &&
+ requested.getFileName() != null &&
+ (requested.getNameCount() == 1 ||
+ DEFAULT_PYTHON_FILE.equals(requested.toString())),
+ "python file is not allowed");
+
+ String scriptName = requested.getFileName().toString();
+ List<String> allowlist =
+ this.configValue(HubbleOptions.LANGCHAIN_SCRIPT_ALLOWLIST);
+ E.checkArgument(allowlist.contains(scriptName),
+ "python file is not allowed");
+
+ Path root =
Paths.get(this.configValue(HubbleOptions.LANGCHAIN_SCRIPT_DIR))
+ .normalize();
+ E.checkArgument(root.toFile().isDirectory(),
+ "langchain script dir not exist");
+ Path script = root.resolve(scriptName).normalize();
+ E.checkArgument(script.startsWith(root), "python file is not allowed");
+ E.checkArgument(script.toFile().exists(), "python file not exist");
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
This path depends on a [user-provided value](2).
This path depends on a [user-provided value](3).
[Show more
details](https://github.com/apache/hugegraph-toolchain/security/code-scanning/85)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
