Conversation
This commit introduces a new view and template for connecting to a server and executing a script via SSH. It also updates the navigation bar to include links to the new functionality and enhances the base template with improved structure and Bootstrap integration.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
/review |
PR Reviewer Guide 🔍(Review updated until commit 7e31173)Here are some key observations to aid the review process:
|
|
Persistent review updated to latest commit 7e31173 |
PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||
| def post(self, request): | ||
| server = request.POST.get("server", "") | ||
| username = request.POST.get("username", "") | ||
| script = request.POST.get("script", "") | ||
| cmd = f'ssh {username}@{server} "bash /opt/scripts/{script}.sh"' | ||
| os.system(cmd) |
There was a problem hiding this comment.
Security Vulnerability: Command Injection Risk
This implementation contains a critical security vulnerability. The code directly interpolates user-provided inputs (server, username, and script) into a shell command without proper validation or sanitization:
cmd = f'ssh {username}@{server} "bash /opt/scripts/{script}.sh"'
os.system(cmd)This creates a command injection vulnerability where attackers could inject arbitrary commands by manipulating any of these fields. For example, an attacker could input a username like user; rm -rf / to execute destructive commands.
Recommendation:
- Replace
os.system()with a secure SSH library like Paramiko - Implement strict input validation for all user-provided values
- Consider using parameterized commands rather than string interpolation
- Add proper error handling and logging
This is a high-priority security issue that should be addressed before deployment.
| def post(self, request): | |
| server = request.POST.get("server", "") | |
| username = request.POST.get("username", "") | |
| script = request.POST.get("script", "") | |
| cmd = f'ssh {username}@{server} "bash /opt/scripts/{script}.sh"' | |
| os.system(cmd) | |
| def post(self, request): | |
| server = request.POST.get("server", "") | |
| username = request.POST.get("username", "") | |
| script = request.POST.get("script", "") | |
| # Input validation | |
| if not all([server, username, script]) or not re.match(r'^[a-zA-Z0-9_-]+$', script): | |
| return HttpResponse("Invalid input parameters", status=400) | |
| try: | |
| # Use paramiko for secure SSH connection | |
| import paramiko | |
| client = paramiko.SSHClient() | |
| client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) | |
| # Connect with timeout | |
| client.connect(hostname=server, username=username, timeout=10) | |
| # Execute command securely | |
| command = f"bash /opt/scripts/{script}.sh" | |
| stdin, stdout, stderr = client.exec_command(command) | |
| # Get command output | |
| result = stdout.read().decode('utf-8') | |
| error = stderr.read().decode('utf-8') | |
| # Close connection | |
| client.close() | |
| if error: | |
| logger.error(f"Script execution error: {error}") | |
| return HttpResponse(f"Error executing script: {error}", status=500) | |
| return HttpResponse(result) | |
| except Exception as e: | |
| logger.error(f"SSH connection error: {str(e)}") | |
| return HttpResponse(f"Connection error: {str(e)}", status=500) |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
User description
This commit introduces a new view and template for connecting to a server and executing a script via SSH. It also updates the navigation bar to include links to the new functionality and enhances the base template with improved structure and Bootstrap integration.
PR Type
Enhancement
Description
Add SSH script execution functionality with form interface
Update navigation with new menu items
Improve base template formatting and structure
Implement Connect & Run Script view with POST handling
Changes diagram
Changes walkthrough 📝
urls.py
Add new URL routes for SSH functionalitypages/urls.py
syscallandconnect_and_runviewsviews.py
Implement SSH script execution viewpages/views.py
ConnectAndRunScriptViewclass with GET/POST methodsos.system()_base.html
Update navigation and improve template formattingtemplates/_base.html
connect_and_run.html
Create SSH script execution form templatetemplates/pages/connect_and_run.html