PXP-11141 PPS-590 PPS-592 PPS-593 PPS-594 PPS-595 PPS-596 PPS-597 PPS…

…-598 Update dependencies (#34)

.github/workflows/test.yaml

@@ -0,0 +1,18 @@
+name: Unit Tests
+
+on:
+  push:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  UnitTest:
+    name: Python Unit Test
+    uses: uc-cdis/.github/.github/workflows/python_unit_test.yaml@master
+    with:
+      python-version: '3.9'
+      setup-script: 'tests/ci_setup.sh'

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 -   repo: [email protected]:Yelp/detect-secrets
-    rev: v0.13.1
+    rev: v1.4.0
     hooks:
     -   id: detect-secrets
         args: ['--baseline', '.secrets.baseline']
@@ -13,6 +13,6 @@ repos:
     -   id: no-commit-to-branch
         args: [--branch, develop, --branch, master, --pattern, release/.*]
 -   repo: https://github.com/psf/black
-    rev: 20.8b1
+    rev: 23.10.0
     hooks:
     -   id: black

Dockerfile

@@ -1,7 +1,7 @@
 # To run: docker run -v /path/to/wsgi.py:/var/www/manifestservice/wsgi.py --name=manifestservice -p 81:80 manifestservice
 # To check running container: docker exec -it manifestservice /bin/bash
 
-FROM quay.io/cdis/python:python3.6-buster-pybase3-3.0.2
+FROM quay.io/cdis/python:python3.9-buster-2.0.0
 
 ENV appname=manifestservice
 
@@ -13,7 +13,7 @@ RUN pip install --upgrade poetry
 RUN apt-get update \
     && apt-get install -y --no-install-recommends\
     libmcrypt4 libmhash2 mcrypt \
-    curl bash git \
+    curl bash git vim \
     && apt-get clean
 
 RUN mkdir -p /var/www/$appname \

manifestservice/manifests/__init__.py

@@ -1,4 +1,5 @@
 import flask
+import html
 import boto3
 from flask import current_app as app
 import re
@@ -67,6 +68,7 @@ def get_manifest_file(file_name):
     if err is not None:
         return err, code
 
+    file_name = html.escape(file_name)
     if not file_name.endswith("json"):
         json_to_return = {
             "error": "Incorrect usage. You can only use this pathway to request files of type JSON."
@@ -93,7 +95,6 @@ def put_manifest():
         400:
             description: Bad manifest format
     """
-
     err, code = _authenticate_user()
     if err is not None:
         return err, code
@@ -415,8 +416,9 @@ def _authenticate_user():
     If the user's access token is invalid, they get a 403.
     If the user lacks read access on at least one project, they get a 403.
     """
+    audience = flask.current_app.config["OIDC_ISSUER"]
     try:
-        set_current_token(validate_request(aud={"user"}))
+        set_current_token(validate_request(scope={"user"}, audience=audience))
     except Exception as e:
         logger.error(e)
         json_to_return = {"error": "Please log in."}