mik-laj commented on code in PR #26162:
URL: https://github.com/apache/airflow/pull/26162#discussion_r963673557
##########
airflow/providers/docker/hooks/docker.py:
##########
@@ -66,46 +81,51 @@ def __init__(
if not docker_conn_id:
raise AirflowException('No Docker connection id provided')
-
- conn = self.get_connection(docker_conn_id)
-
- if not conn.host:
- raise AirflowException('No Docker URL provided')
- if not conn.login:
- raise AirflowException('No username provided')
- extra_options = conn.extra_dejson
-
+ self.docker_conn_id = docker_conn_id
self.__base_url = base_url
self.__version = version
self.__tls = tls
self.__timeout = timeout
- if conn.port:
- self.__registry = f"{conn.host}:{conn.port}"
- else:
- self.__registry = conn.host
- self.__username = conn.login
- self.__password = conn.password
- self.__email = extra_options.get('email')
- self.__reauth = extra_options.get('reauth') != 'no'
- def get_conn(self) -> APIClient:
+ @cached_property
+ def api_client(self) -> APIClient:
+ """Create connection to docker host and login to the docker
registries. (cached)"""
+ conn = self.get_connection(self.docker_conn_id)
client = APIClient(
base_url=self.__base_url, version=self.__version, tls=self.__tls,
timeout=self.__timeout
)
- self.__login(client)
+
+ credential_helper = conn.extra_dejson.get("credential_helper")
+ if not credential_helper:
+ # If not specified credential helper than retrieve information
from Connection.
+ credential_helper = AirflowConnectionDockerCredentialHelper
+ credential_helper_kwargs = {}
+ else:
+ credential_helper = import_string(credential_helper)
Review Comment:
There is no need for the class to be specially downloaded, as the
class/function may already exist in any packages installed in the system, but
we can misuse it.
I will have a hard time giving an example for Python now, but here you can
see what an attack looks like in Java.
https://wololo.net/2022/06/11/ps5-ps4-hacker-theflow-discloses-blu-ray-disc-exploit-toolchain-ps5-piracy-not-a-matter-of-if-but-when/
> The class com.sony.gemstack.org.dvb.user.UserPreferenceManagerImpl
deserializes the userprefs file under privileged context using readObject()
which is insecure
> The class com.oracle.security.Service contains a method newInstance which
calls Class.forName on an arbitrary class name. This allows arbitrary classes,
even restricted ones (for example in sun.), to be instantiated.
> The class com.sony.gemstack.org.dvb.io.ixc.IxcProxy contains the protected
method invokeMethod which can call methods under privileged context. Permission
checks in methods can be bypassed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
