set up pre-commit with black and isort - #38
Merged
Merged
Conversation
singingwolfboy
force-pushed
the
pre-commit
branch
from
June 15, 2022 09:18
57ae83b to
aad4e51
Compare
orishavit
approved these changes
Jun 16, 2022
4 tasks
dshoen619
added a commit
that referenced
this pull request
Jul 24, 2026
… (PER-15358) (#328) * fix: clear remaining pdp-v2 image CVEs from customer scan (PER-15358) A customer scan of permitio/pdp-v2:0.9.13 surfaced 43 unique CVEs. Most were already fixed after 0.9.13 was cut (Go deps via permit-opa #38, cryptography pin, and the libssl3/pyjwt/aiohttp bumps a rebuild picks up automatically). This covers what was genuinely left. Fixed: * GHSA-27jp-wm6q-gp25 - sqlparse 0.5.0 -> 0.5.5 (fixed in 0.5.4). Note sqlparse is never imported; it has only ever been carried as a floor pin from past vuln sweeps. Flagged inline as a removal candidate. Waived (unreachable code paths, verified against the source): * CVE-2026-48710 - malformed Host header desyncs request.url.path from the routed path. No PDP security decision reads request.url: auth is per-route via FastAPI Depends/HTTPBearer, there is no add_middleware or BaseHTTPMiddleware, and the one path-keyed check (cloud_proxy) reads request.path_params, which the router fills from the raw scope path. * CVE-2026-48817 - unsafe getattr dispatch in starlette HTTPEndpoint. The PDP defines no HTTPEndpoint/WebSocketEndpoint subclass; every route is an APIRouter decorator with explicit methods. Both are fixed only in starlette >=1.x, which OPAL's starlette<1 cap forbids, so they join the two existing starlette waivers. Dropped: * CVE-2026-50163 (oras-go) - waiver removed; oras-go v2.6.2 fixes it and permit-opa now pins it. That bump MUST merge to permit-opa@main before this branch merges, since the PDP build clones permit-opa@main and the scout gate will otherwise fail with the waiver gone. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: mitigate ddtrace baggage DoS CVE-2026-50271 (PER-15358) The Docker Scout gate surfaced a second HIGH beyond the customer's report: CVE-2026-50271 (CVSS 7.5), a remote DoS in ddtrace's W3C baggage propagator. The extract path ignores DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, so an unauthenticated caller can drive unbounded CPU/memory with an oversized baggage header. This is not introduced here - main would fail the same gate today; the advisory simply postdates main's last green run (Jul 14). The fix is only in ddtrace >= 4.8.2 and opal-common 0.9.6 caps ddtrace<4, so it cannot be upgraded away. Rather than waive on the default posture alone, remove the vulnerable parser from the request path: set DD_TRACE_PROPAGATION_STYLE_EXTRACT=datadog,tracecontext, dropping "baggage" from ddtrace's default extract styles. That matters because the exposure is real, just config-gated. ddtrace only reaches inbound requests when PDP_ENABLE_MONITORING=true (default false) calls patch(fastapi=True) - but baggage IS in ddtrace's default extract styles, so anyone who enables monitoring would otherwise be genuinely exposed. A "not in execute path" waiver would have been false for them. Injection is left at its default, so outbound baggage propagation is unchanged. Waived as inline_mitigations_already_exist, which is accurate for both the default and monitoring-enabled configurations. ddtrace is pinned to 3.19.8 so the waiver PURL stays bound (no lockfile in the image build). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.