Add database backup route #417
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Warnings seen in CI |
Limit file access to the temporary directory we create. Hopefully addresses the code scanning alert about https://brakemanscanner.org/docs/warning_types/file_access/ Suggested by @jage at #417 (comment)
| rel_path = Base64.urlsafe_decode64(params.fetch("encoded_path")) | ||
| dump_path = File.join(backup_tmpdir, rel_path) | ||
|
|
||
| send_file dump_path, type: "text/plain" |
Check notice
Code scanning / Brakeman
Parameter value used in file name.
|
Looked at ignoring the warning from Brakeman now that we have adequately addressed it. Not pleased with what I found 😞
|
|
Looks like the ignore is kinda specific, adding get '/foo/:foo' do
send_file params["foo"]
endto another file, and also the same file, generates a new warning (not ignored). Adding some lines of code to the |
|
Looks like it didn't work :/ https://github.com/Starkast/wikimum/security/code-scanning?query=is%3Aopen+pr%3A417 still reports 1 open alert: https://github.com/Starkast/wikimum/security/code-scanning/3 |
|
Another disappointment, GitHub doesn't support suppressions in the uploaded SARIF 😞 github/codeql-action#1230 (comment) |
|
I dismissed the alert now, it had me give a reason (gave it |
Close #413 The SQL dump can be downloaded with curl --verbose --silent --location --request POST --user user:pass --output test.sql http://localhost:8080/.backup
/home/runner/work/wikimum/wikimum/test/integration/app_backup_test.rb:43: warning: ambiguous first argument; put parentheses or a space even after `/' operator /home/runner/work/wikimum/wikimum/test/integration/app_backup_test.rb:67: warning: ambiguous first argument; put parentheses or a space even after `/' operator
Now the temporary file will be automatically deleted when the Ruby interpreter exits. https://ruby-doc.org/stdlib-2.7.6/libdoc/tempfile/rdoc/Tempfile.html#new-method
Limit file access to the temporary directory we create. Hopefully addresses the code scanning alert about https://brakemanscanner.org/docs/warning_types/file_access/ Suggested by @jage at #417 (comment)
The file access is limited to a temporary directory we create.
This string ends up in the "justification" attribute in the SARIF output, and apparently it is not valid SARIF if it isn't a string (it was null). From https://github.com/Starkast/wikimum/actions/runs/3465429770/jobs/5788144432#step:6:26 > Error: Unable to upload "output.sarif.json" as it is not valid SARIF:
dentarg
force-pushed
the
database-backup
branch
from
1855075
to
f553fc3
Compare
Close #413
The SQL dump can be downloaded with