Skip to content

Commit

Permalink
dcnm_fabric: hardening (#349)
Browse files Browse the repository at this point in the history
Two bits of vulnerable code found when porting to ndfc-python.

1. plugins/modules/dcnm_fabric.py

Accessing dictionary key directly can lead to a KeyError exception.

2. plugins/module_utils/fabric/replaced.py

If user omits the DEPLOY parameter from their playbook (ndfc-python) the DEPLOY key would be None, and not get popped from the payload.  This would cause NDFC to complain about an invalid key in the payload.  We need to unconditionally pop DEPLOY here, if it's present.  Hence, we've removed the value check (if DEPLOY is not None).
  • Loading branch information
allenrobel authored Dec 3, 2024
1 parent cae4142 commit 7b8775e
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion plugins/module_utils/fabric/replaced.py
Original file line number Diff line number Diff line change
Expand Up @@ -468,7 +468,7 @@ def _send_payloads(self):

for payload in self._payloads_to_commit:
commit_payload = copy.deepcopy(payload)
if commit_payload.get("DEPLOY", None) is not None:
if "DEPLOY" in commit_payload:
commit_payload.pop("DEPLOY")
try:
self._send_payload(commit_payload)
Expand Down
4 changes: 2 additions & 2 deletions plugins/modules/dcnm_fabric.py
Original file line number Diff line number Diff line change
Expand Up @@ -3032,7 +3032,7 @@ def get_need(self):
fabric_name = want.get("FABRIC_NAME", None)
fabric_type = want.get("FABRIC_TYPE", None)

if self.features[fabric_type] is False:
if self.features.get("fabric_type") is False:
msg = f"{self.class_name}.{method_name}: "
msg += f"Features required for fabric {fabric_name} "
msg += f"of type {fabric_type} are not running on the "
Expand Down Expand Up @@ -3361,7 +3361,7 @@ def get_need(self):
self.need_create.append(want)
continue

if self.features[fabric_type] is False:
if self.features.get("fabric_type") is False:
msg = f"{self.class_name}.{method_name}: "
msg += f"Features required for fabric {fabric_name} "
msg += f"of type {fabric_type} are not running on the "
Expand Down

0 comments on commit 7b8775e

Please sign in to comment.