Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix security vulnerability by specifying a secure requests version. #72

Merged
merged 9 commits into from
Jan 26, 2019

Conversation

gkapfham
Copy link
Collaborator

No description provided.

@gkapfham gkapfham self-assigned this Nov 21, 2018
@gkapfham
Copy link
Collaborator Author

gkapfham commented Nov 21, 2018

Hello @Michionlion! I am writing to let you know that GitHub flagged a security problem in GatorGrader because of the fact that the tool is transitively depending on the requests package at a * version. This would mean that we are getting a version that is older than the very recent one that fixed a security vulnerability. However, I am now finding that I can no longer use pipenv on Travis CI with the configurations that we have previously adopted.

There is already an issue about this, but it was closed and I do not understand the comments well enough to see how to re-configure Travis CI. Here is the reference: pypa/pipenv#3247. I should also point out that this might be an active bug for which a fix is in the works, according to pypa/pipenv#3265.

Finally, I'm wondering whether or not this would be an issue for the Gradle plugin and its installation of GatorGrader's dependencies through pipenv? Let me know if you see how to fix the problem or if you think it could become an issue with the Gradle plugin. Thanks! If I hear more on the issue tracker for pipenv, I will follow their advice so as to ensure that this PR passes the build.

@gkapfham gkapfham requested a review from Michionlion December 5, 2018 13:48
Copy link
Member

@Michionlion Michionlion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good! I tested this by doing a quick modification of GatorGradle to pull down this branch and install it (using git clone --branch more-secure-pip <url> <folder> instead of the normal command without --branch <name>), and everything worked great. It doesn't look like there are any issues, and if the CI passes now, this PR should be okay to merge!

@Michionlion Michionlion merged commit 511a7ab into master Jan 26, 2019
@Michionlion Michionlion deleted the more-secure-pip branch January 26, 2019 03:07
@gkapfham
Copy link
Collaborator Author

Thanks for merging @Michionlion!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants