mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
9c3a7cdbec
Four lookups built XPath expressions from values that come from requests (CodeQL py/xpath-injection, plus get_capabilities, which CodeQL did not flag; the pages are for superusers): - The architecture in the create wizard's URLs went into arch[@name='...'] in get_emulator, get_machine_types and get_capabilities: "nope' or '1'='1" matched every architecture. It is now an XPath variable ($arch), which is never parsed as XPath. - Network filter rules were found with a predicate built from the posted action, direction and priority: a quote raised SyntaxError (an error page). The rule is now found by comparing its attributes. - unset_qos put the posted direction into the path, so "*" removed every bandwidth setting. It accepts inbound and outbound, as set_qos does; the network page shows an error for anything else. No other XPath in vrtManager is built from a value; the remaining expressions are constants. The tests fail on the previous code.
132 lines
4.3 KiB
Python
132 lines
4.3 KiB
Python
from xml.etree import ElementTree
|
|
|
|
from vrtManager.connection import wvmConnect
|
|
|
|
|
|
class wvmNWFilters(wvmConnect):
|
|
def get_nwfilter_info(self, name):
|
|
nwfilter = self.get_nwfilter(name)
|
|
xml = nwfilter.XMLDesc(0)
|
|
uuid = nwfilter.UUIDString()
|
|
return {"name": name, "uuid": uuid, "xml": xml}
|
|
|
|
def create_nwfilter(self, xml):
|
|
self.wvm.nwfilterDefineXML(xml)
|
|
|
|
def clone_nwfilter(self, name, cln_name):
|
|
nwfilter = self.get_nwfilter(name)
|
|
if nwfilter:
|
|
tree = ElementTree.fromstring(nwfilter.XMLDesc(0))
|
|
tree.set("name", cln_name)
|
|
uuid = tree.find("uuid")
|
|
tree.remove(uuid)
|
|
self.create_nwfilter(ElementTree.tostring(tree).decode())
|
|
|
|
|
|
class wvmNWFilter(wvmConnect):
|
|
def __init__(self, host, login, passwd, conn, nwfiltername):
|
|
wvmConnect.__init__(self, host, login, passwd, conn)
|
|
self.nwfilter = self.get_nwfilter(nwfiltername)
|
|
|
|
def _XMLDesc(self, flags):
|
|
return self.nwfilter.XMLDesc(flags)
|
|
|
|
def get_uuid(self):
|
|
return self.nwfilter.UUIDString()
|
|
|
|
def get_name(self):
|
|
return self.nwfilter.name()
|
|
|
|
def delete(self):
|
|
self.nwfilter.undefine()
|
|
|
|
def get_xml(self):
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
uuid = tree.find("uuid")
|
|
tree.remove(uuid)
|
|
return ElementTree.tostring(tree).decode()
|
|
|
|
def get_filter_refs(self):
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
return [ref.get("filter") for ref in tree.findall("./filterref")]
|
|
|
|
def get_rules(self):
|
|
rules = []
|
|
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
for r in tree.findall("./rule"):
|
|
rule_action = r.get("action")
|
|
rule_direction = r.get("direction")
|
|
rule_priority = r.get("priority")
|
|
rule_statematch = r.get("statematch")
|
|
|
|
rule_directives = r.find("./")
|
|
if rule_directives is not None:
|
|
rule_directives = ElementTree.tostring(rule_directives).decode()
|
|
|
|
rule_info = {
|
|
"action": rule_action,
|
|
"direction": rule_direction,
|
|
"priority": rule_priority,
|
|
"statematch": rule_statematch,
|
|
"directives": rule_directives,
|
|
}
|
|
|
|
rules.append(rule_info)
|
|
|
|
return rules
|
|
|
|
def delete_ref(self, name):
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
for ref in tree.findall("./filterref"):
|
|
if name == ref.get("filter"):
|
|
tree.remove(ref)
|
|
break
|
|
return ElementTree.tostring(tree).decode()
|
|
|
|
@staticmethod
|
|
def _rules(tree, action, direction, priority):
|
|
# compared, not put into an XPath predicate: the values come from forms
|
|
return [
|
|
rule
|
|
for rule in tree.findall("./rule")
|
|
if (rule.get("action"), rule.get("direction"), rule.get("priority")) == (action, direction, priority)
|
|
]
|
|
|
|
def delete_rule(self, action, direction, priority):
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
|
|
rule_tree = self._rules(tree, action, direction, priority)
|
|
if rule_tree:
|
|
tree.remove(rule_tree[0])
|
|
|
|
return ElementTree.tostring(tree).decode()
|
|
|
|
def add_ref(self, name):
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
element = ElementTree.Element("filterref")
|
|
element.attrib["filter"] = name
|
|
tree.append(element)
|
|
return ElementTree.tostring(tree).decode()
|
|
|
|
def add_rule(self, xml):
|
|
tree = ElementTree.fromstring(self._XMLDesc(0))
|
|
rule = ElementTree.fromstring(xml)
|
|
|
|
rule_action = rule.get("action")
|
|
rule_direction = rule.get("direction")
|
|
rule_priority = rule.get("priority")
|
|
rule_directives = rule.find("./")
|
|
rule_tree = self._rules(tree, rule_action, rule_direction, rule_priority)
|
|
|
|
if rule_tree:
|
|
rule_tree[0].append(rule_directives)
|
|
else:
|
|
element = ElementTree.Element("rule")
|
|
element.attrib["action"] = rule_action
|
|
element.attrib["direction"] = rule_direction
|
|
element.attrib["priority"] = rule_priority
|
|
element.append(rule_directives)
|
|
tree.append(element)
|
|
|
|
return ElementTree.tostring(tree).decode()
|