github-advanced-security[bot] commented on code in PR #75917:
URL: https://github.com/apache/airflow/pull/75917#discussion_r4409387953
##########
providers/git/tests/unit/git/hooks/test_git.py:
##########
@@ -96,6 +111,56 @@
server.server_close()
[email protected]
+def recording_public_https_git_server(tmp_path: pathlib.Path):
+ """Serve 200s over https on loopback, like a public repository, recording
every credential git sends."""
+ received: list[str] = []
+
+ class Public(http.server.BaseHTTPRequestHandler):
+ def do_GET(self):
+ header = self.headers.get("Authorization")
+ if header and header.startswith("Basic "):
+ received.append(base64.b64decode(header[6:]).decode())
+ self.send_response(200)
+ self.send_header("Content-Length", "0")
+ self.end_headers()
+
+ def log_message(self, *args):
+ pass
+
+ key = ec.generate_private_key(ec.SECP256R1())
+ name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "127.0.0.1")])
+ cert = (
+ x509.CertificateBuilder()
+ .subject_name(name)
+ .issuer_name(name)
+ .public_key(key.public_key())
+ .serial_number(1)
+ .not_valid_before(datetime(2000, 1, 1, tzinfo=UTC))
+ .not_valid_after(datetime(2100, 1, 1, tzinfo=UTC))
+ .sign(key, hashes.SHA256())
+ )
+ cert_file = tmp_path / "cert.pem"
+ key_file = tmp_path / "key.pem"
+ cert_file.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+ key_file.write_bytes(
+ key.private_bytes(
+ serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
serialization.NoEncryption()
+ )
+ )
+ context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+ context.load_cert_chain(cert_file, key_file)
+
+ server = socketserver.TCPServer(("127.0.0.1", 0), Public)
+ server.socket = context.wrap_socket(server.socket, server_side=True)
Review Comment:
## CodeQL / Use of insecure SSL/TLS version
Insecure SSL/TLS protocol version TLSv1 allowed by [call to
ssl.SSLContext](1).
Insecure SSL/TLS protocol version TLSv1_1 allowed by [call to
ssl.SSLContext](1).
[Show more
details](https://github.com/apache/airflow/security/code-scanning/691)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
