diff --git a/docs/changes/5.5.0.md b/docs/changes/5.5.0.md index bfdf86e185..faf35b0f80 100644 --- a/docs/changes/5.5.0.md +++ b/docs/changes/5.5.0.md @@ -4,7 +4,7 @@ Release date: `2024-xx-xx` ## Core -- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2): +- [NXDRIVE-2920](https://jira.nuxeo.com/browse/NXDRIVE-2920): Upgrade to TLS 1.2 ### Direct Edit @@ -20,11 +20,12 @@ Release date: `2024-xx-xx` ## Packaging / Build -- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2): +- [NXDRIVE-2928](https://jira.nuxeo.com/browse/NXDRIVE-2928): Fix security issue IDNA vulnerable to denial of service from specially crafted inputs to idna.encode +- [NXDRIVE-2936] (https://jira.nuxeo.com/browse/NXDRIVE-2936): Fix security issue Requests Session object does not verify requests after making first request with verify=False ## Tests -- [NXDRIVE-2](https://jira.nuxeo.com/browse/NXDRIVE-2): +- [NXDRIVE-2933](https://jira.nuxeo.com/browse/NXDRIVE-2933): Fix redos in py library when used with subversion ## Docs @@ -32,11 +33,28 @@ Release date: `2024-xx-xx` ## Minor Changes +- Added `cachetools` 5.3.3 +- Added `pyproject-api` 1.6.1 +- Removed `py` 1.10.0 +- Removed `pytest-forked` 1.6.0 - Upgraded `build` from 1.1.1 to 1.2.1 +- Upgraded `chardet` from 4.0.0 to 5.2.0 - Upgraded `exceptiongroup` from 1.2.0 to 1.2.1 +- Upgraded `filelock` from 3.12.4 to 3.14.0 - Upgraded `identify` from 2.5.33 to 2.5.36 +- Upgraded `idna` from 3.6 to 3.7 - Upgraded `junitparser` from 3.1.1 to 3.1.2 - Upgraded `mypy` from 1.5.1 to 1.10.0 +- Upgraded `platformdirs` from 4.2.0 to 4.2.2 +- Upgraded `pluggy` from 1.4.0 to 1.5.0 +- Upgraded `pytest` from 7.4.4 to 8.2.1 +- Upgraded `py-cpuinfo` from 8.0.0 to 9.0.0 +- Upgraded `pytest-benchmark` from 3.4.1 to 4.0.0 +- Upgraded `pytest-cov` from 4.1.0 to 5.0.0 +- Upgraded `pytest-timeout` from 2.2.0 to 2.3.1 +- Upgraded `requests` from 2.31.0 to 2.32.2 +- Upgraded `tox` from 3.24.5 to 4.15.0 +- Upgraded `virtualenv` from 20.4.7 to 20.26.2 ## Technical Changes diff --git a/nxdrive/utils.py b/nxdrive/utils.py index 1b7c5cec92..1251fd66b2 100644 --- a/nxdrive/utils.py +++ b/nxdrive/utils.py @@ -68,6 +68,8 @@ "notBefore": "N/A", } +MINIMUM_TLS_VERSION = "TLSv1_2" + log = getLogger(__name__) @@ -604,7 +606,11 @@ def retrieve_ssl_certificate(hostname: str, /, *, port: int = 443) -> str: import ssl with ssl.create_connection((hostname, port)) as conn: # type: ignore - with ssl.SSLContext().wrap_socket(conn, server_hostname=hostname) as sock: + # Declaring a minimum version to restrict the protocol + # For more information check NXDRIVE-2920 + context = ssl.create_default_context() + context.minimum_version = getattr(ssl.TLSVersion, MINIMUM_TLS_VERSION) + with context.wrap_socket(conn, server_hostname=hostname) as sock: cert_data: bytes = sock.getpeercert(binary_form=True) # type: ignore return ssl.DER_cert_to_PEM_cert(cert_data) diff --git a/tests/old_functional/test_direct_transfer.py b/tests/old_functional/test_direct_transfer.py index 63309ab93a..3956342358 100644 --- a/tests/old_functional/test_direct_transfer.py +++ b/tests/old_functional/test_direct_transfer.py @@ -725,7 +725,7 @@ def checks(self, created): assert not self.engine_1.dao.get_errors(limit=0) def direct_transfer(self, folder, duplicate_behavior: str = "create") -> None: - paths = {path: size for path, size in get_tree_list(folder)} + paths = dict(get_tree_list(folder)) self.engine_1.direct_transfer( paths, self.ws.path, diff --git a/tools/deps/requirements-bench.txt b/tools/deps/requirements-bench.txt index 235dc64fb0..1c8cdf3a30 100644 --- a/tools/deps/requirements-bench.txt +++ b/tools/deps/requirements-bench.txt @@ -2,8 +2,9 @@ # Modules needed by benchmarks. # This file is independent to not pollute other test environments. # -py-cpuinfo==8.0.0 \ - --hash=sha256:5f269be0e08e33fd959de96b34cd4aeeeacac014dd8305f70eb28d06de2345c5 -pytest-benchmark==3.4.1 \ - --hash=sha256:36d2b08c4882f6f997fd3126a3d6dfd70f3249cde178ed8bbc0b73db7c20f809 \ - --hash=sha256:40e263f912de5a81d891619032983557d62a3d85843f9a9f30b98baea0cd7b47 +pytest-benchmark==4.0.0 \ + --hash=sha256:fb0785b83efe599a6a956361c0691ae1dbb5318018561af10f3e915caa0048d1 \ + --hash=sha256:fdb7db64e31c8b277dff9850d2a2556d8b60bcb0ea6524e36e28ffd7c87f71d6 +py-cpuinfo==9.0.0 \ + --hash=sha256:3cdbbf3fac90dc6f118bfd64384f309edeadd902d7c8fb17f02ffa1fc3f49690 \ + --hash=sha256:859625bc251f64e21f077d099d4162689c762b5d6a4c3c97553d56241c9674d5 diff --git a/tools/deps/requirements-pip.txt b/tools/deps/requirements-pip.txt index 821f4e75a2..91f68a24fa 100644 --- a/tools/deps/requirements-pip.txt +++ b/tools/deps/requirements-pip.txt @@ -10,7 +10,7 @@ click==8.1.7 \ --hash=sha256:ae74fb96c20a0277a1d615f1e4d73c8414f5a98db8b799a7931d1582f3390c28 \ --hash=sha256:ca9853ad459e787e2192211578cc907e7594e294c7ccc834310722b41b9ca6de # via pip-tools -colorama==0.4.6 ; sys_platform == "win32" \ +colorama==0.4.6 \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 # via click diff --git a/tools/deps/requirements-tests.txt b/tools/deps/requirements-tests.txt index b9a8aa8035..f7e9accc8f 100644 --- a/tools/deps/requirements-tests.txt +++ b/tools/deps/requirements-tests.txt @@ -45,7 +45,7 @@ click==8.1.7 \ codespell==2.2.6 \ --hash=sha256:9ee9a3e5df0990604013ac2a9f22fa8e57669c827124a2e961fe8a1da4cacc07 \ --hash=sha256:a8c65d8eb3faa03deabab6b3bbe798bea72e1799c7e9e955d57eca4096abcff9 -colorama==0.4.6; sys_platform == "win32" \ +colorama==0.4.6 \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 # via pytest @@ -195,21 +195,17 @@ pathspec==0.12.1 \ --hash=sha256:a0d503e138a4c123b27490a4f7beda6a01c6f288df0e4a8b79c7eb0dc7b4cc08 \ --hash=sha256:a482d51503a1ab33b1c67a6c3813a26953dbdc71c31dacaef9a838c4e29f5712 # via black -platformdirs==4.2.0 \ - --hash=sha256:0614df2a2f37e1a662acbd8e2b25b92ccf8632929bc6d43467e17fe89c75e068 \ - --hash=sha256:ef0cc731df711022c174543cb70a9b5bd22e5a9337c8624ef2c2ceb8ddad8768 +platformdirs==4.2.2 \ + --hash=sha256:2d7a1657e36a80ea911db832a8a6ece5ee53d8de21edd5cc5879af6530b1bfee \ + --hash=sha256:38b7b51f512eed9e84a22788b4bce1de17c0adb134d6becb09836e37d8654cd3 # via black -pluggy==1.4.0 \ - --hash=sha256:7db9f7b503d67d1c5b95f59773ebb58a8c1c288129a88665838012cfb07b8981 \ - --hash=sha256:8c85c2876142a764e5b7548e7d9a0e0ddb46f5185161049a79b7e974454223be +pluggy==1.5.0 \ + --hash=sha256:2cffa88e94fdc978c4c574f15f9e59b7f4201d439195c3715ca9e2486f1d0cf1 \ + --hash=sha256:44e1ad92c8ca002de6377e165f3e0f1be63266ab4d554740532335b9d75ea669 # via pytest pre-commit==2.16.0 \ --hash=sha256:758d1dc9b62c2ed8881585c254976d66eae0889919ab9b859064fc2fe3c7743e \ --hash=sha256:fe9897cac830aa7164dbd02a4e7b90cae49630451ce88464bca73db486ba9f65 -py==1.10.0 \ - --hash=sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a \ - --hash=sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3 - # via pytest pycodestyle==2.11.1 \ --hash=sha256:41ba0e7afc9752dfb53ced5489e89f8186be00e599e712660695b7a75ff2663f \ --hash=sha256:44fe31000b2d866f2e41841b18528a505fbd7fef9017b04eff4e2648a0fadc67 @@ -225,22 +221,18 @@ pyparsing==2.4.7 \ --hash=sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1 \ --hash=sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b # via packaging -pytest-cov==4.1.0 \ - --hash=sha256:3904b13dfbfec47f003b8e77fd5b589cd11904a21ddf1ab38a64f204d6a10ef6 \ - --hash=sha256:6ba70b9e97e69fcc3fb45bfeab2d0a138fb65c4d0d6a41ef33983ad114be8c3a -pytest-forked==1.6.0 \ - --hash=sha256:4dafd46a9a600f65d822b8f605133ecf5b3e1941ebb3588e943b4e3eb71a5a3f \ - --hash=sha256:810958f66a91afb1a1e2ae83089d8dc1cd2437ac96b12963042fbb9fb4d16af0 - # via pytest-xdist -pytest-timeout==2.2.0 \ - --hash=sha256:3b0b95dabf3cb50bac9ef5ca912fa0cfc286526af17afc806824df20c2f72c90 \ - --hash=sha256:bde531e096466f49398a59f2dde76fa78429a09a12411466f88a07213e220de2 +pytest-cov==5.0.0 \ + --hash=sha256:4f0764a1219df53214206bf1feea4633c3b558a2925c8b59f144f682861ce652 \ + --hash=sha256:5837b58e9f6ebd335b0f8060eecce69b662415b16dc503883a02f45dfeb14857 +pytest-timeout==2.3.1 \ + --hash=sha256:12397729125c6ecbdaca01035b9e5239d4db97352320af155b3f5de1ba5165d9 \ + --hash=sha256:68188cb703edfc6a18fad98dc25a3c61e9f24d644b0b70f33af545219fc7813e pytest-xdist==3.5.0 \ --hash=sha256:cbb36f3d67e0c478baa57fa4edc8843887e0f6cfc42d677530a36d7472b32d8a \ --hash=sha256:d075629c7e00b611df89f490a5063944bee7a4362a5ff11c7cc7824a03dfce24 -pytest==7.4.4 \ - --hash=sha256:2cf0005922c6ace4a3e2ec8b4080eb0d9753fdc93107415332f50ce9e7994280 \ - --hash=sha256:b090cdf5ed60bf4c45261be03239c2c1c22df034fbffe691abe93cd80cea01d8 +pytest==8.2.1 \ + --hash=sha256:5046e5b46d8e4cac199c373041f26be56fdb81eb4e67dc11d4e10811fc3408fd \ + --hash=sha256:faccc5d332b8c3719f40283d0d44aa5cf101cec36f88cde9ed8f2bc0538612b1 # via pytest-cov, pytest-forked, pytest-timeout, pytest-xdist pywinauto==0.6.8 ; sys_platform == "win32" \ --hash=sha256:931ce622d7f402b1892ab472987a1332e4c0681bf87e106f798390d16ca95e58 diff --git a/tools/deps/requirements-tox.txt b/tools/deps/requirements-tox.txt index 635da349ea..2fc31d3a2c 100644 --- a/tools/deps/requirements-tox.txt +++ b/tools/deps/requirements-tox.txt @@ -6,7 +6,15 @@ appdirs==1.4.4 \ --hash=sha256:a841dacd6b99318a741b166adb07e19ee71a274450e68237b4650ca1055ab128 \ --hash=sha256:7d5d0167b2b1ba821647616af46a749d1c653740dd0d2415100fe26e27afdf41 # via virtualenv -colorama==0.4.6; sys_platform == "win32" \ +cachetools==5.3.3 \ + --hash=sha256:0abad1021d3f8325b2fc1d2e9c8b9c9d57b04c3932657a72465447332c24d945 \ + --hash=sha256:ba29e2dfa0b8b556606f097407ed1aa62080ee108ab0dc5ec9d6a723a007d105 + # via tox +chardet==5.2.0 \ + --hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 \ + --hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970 + # via tox +colorama==0.4.6 \ --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 # via tox @@ -14,9 +22,9 @@ distlib==0.3.8 \ --hash=sha256:034db59a0b96f8ca18035f36290806a9a6e6bd9d1ff91e45a7f172eb17e51784 \ --hash=sha256:1530ea13e350031b6312d8580ddb6b27a104275a31106523b8f123787f494f64 # via virtualenv -filelock==3.12.4 \ - --hash=sha256:08c21d87ded6e2b9da6728c3dff51baf1dcecf973b768ef35bcbc3447edb9ad4 \ - --hash=sha256:2e6f249f1f3654291606e046b09f1fd5eac39b360664c27f5aad072012f8bcbd +filelock==3.14.0 \ + --hash=sha256:43339835842f110ca7ae60f1e1c160714c5a6afd15a2873419ab185334975c0f \ + --hash=sha256:6ea72da3be9b8c82afd3edcf99f2fffbb5076335a5ae4d03248bb5b6c3eae78a # via tox importlib-metadata==7.0.1 \ --hash=sha256:4805911c3a4ec7c3966410053e9ec6a1fecd629117df5adee56dfc9432a1081e \ @@ -26,18 +34,22 @@ packaging==24.0 \ --hash=sha256:2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5 \ --hash=sha256:eb82c5e3e56209074766e6885bb04b8c38a0c015d0a30036ebe7ece34c9989e9 # via tox -pluggy==1.4.0 \ - --hash=sha256:7db9f7b503d67d1c5b95f59773ebb58a8c1c288129a88665838012cfb07b8981 \ - --hash=sha256:8c85c2876142a764e5b7548e7d9a0e0ddb46f5185161049a79b7e974454223be - # via tox -py==1.10.0 \ - --hash=sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a \ - --hash=sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3 +platformdirs==4.2.2 \ + --hash=sha256:2d7a1657e36a80ea911db832a8a6ece5ee53d8de21edd5cc5879af6530b1bfee \ + --hash=sha256:38b7b51f512eed9e84a22788b4bce1de17c0adb134d6becb09836e37d8654cd3 + # via black +pluggy==1.5.0 \ + --hash=sha256:2cffa88e94fdc978c4c574f15f9e59b7f4201d439195c3715ca9e2486f1d0cf1 \ + --hash=sha256:44e1ad92c8ca002de6377e165f3e0f1be63266ab4d554740532335b9d75ea669 # via tox pyparsing==2.4.7 \ --hash=sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b \ --hash=sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1 # via packaging +pyproject-api==1.6.1 \ + --hash=sha256:1817dc018adc0d1ff9ca1ed8c60e1623d5aaca40814b953af14a9cf9a5cae538 \ + --hash=sha256:4c0116d60476b0786c88692cf4e325a9814965e2469c5998b830bba16b183675 + # via tox six==1.16.0 \ --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254 \ --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 @@ -46,16 +58,23 @@ toml==0.10.2 \ --hash=sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b \ --hash=sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f # via tox -tox==3.24.5 \ - --hash=sha256:be3362472a33094bce26727f5f771ca0facf6dafa217f65875314e9a6600c95c \ - --hash=sha256:67e0e32c90e278251fea45b696d0fef3879089ccbe979b0c556d35d5a70e2993 +tox==4.15.0 \ + --hash=sha256:300055f335d855b2ab1b12c5802de7f62a36d4fd53f30bd2835f6a201dda46ea \ + --hash=sha256:7a0beeef166fbe566f54f795b4906c31b428eddafc0102ac00d20998dd1933f6 +tomli==2.0.1 \ + --hash=sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc \ + --hash=sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f + # via + # build + # pip-tools + # pyproject-hooks typing-extensions==4.9.0 \ --hash=sha256:23478f88c37f27d76ac8aee6c905017a143b0b1b886c3c9f66bc2fd94f9f5783 \ --hash=sha256:af72aea155e91adfc61c3ae9e0e342dbc0cba726d6cba4b6c72c1f34e47291cd # via importlib-metadata -virtualenv==20.4.7 \ - --hash=sha256:2b0126166ea7c9c3661f5b8e06773d28f83322de7a3ff7d06f0aed18c9de6a76 \ - --hash=sha256:14fdf849f80dbb29a4eb6caa9875d476ee2a5cf76a5f5415fa2f1606010ab467 +virtualenv==20.26.2 \ + --hash=sha256:82bf0f4eebbb78d36ddaee0283d43fe5736b53880b8a8cdcd37390a07ac3741c \ + --hash=sha256:a624db5e94f01ad993d476b9ee5346fdf7b9de43ccaee0e0197012dc838a0e9b # via tox zipp==3.18.0 \ --hash=sha256:c1bb803ed69d2cce2373152797064f7e79bc43f0a3748eb494096a867e0ebf79 \ diff --git a/tools/deps/requirements.txt b/tools/deps/requirements.txt index 8ca193c012..557eebd10d 100644 --- a/tools/deps/requirements.txt +++ b/tools/deps/requirements.txt @@ -72,9 +72,9 @@ cffi==1.16.0 \ --hash=sha256:fa3a0128b152627161ce47201262d3140edb5a5c3da88d73a1b790a959126956 \ --hash=sha256:fcc8eb6d5902bb1cf6dc4f187ee3ea80a1eba0a89aba40a5cb20a5087d961357 # via cryptography -chardet==4.0.0 \ - --hash=sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5 \ - --hash=sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa +chardet==5.2.0 \ + --hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 \ + --hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970 # via requests charset-normalizer==2.1.1 \ --hash=sha256:5a3d016c7c547f69d6f81fb0db9449ce888b418b5b9952cc5e6e66843e9dd845 \ @@ -197,9 +197,9 @@ dukpy==0.3.1 \ --hash=sha256:f9500f910c0e50ec98763e7ff3c2e553f40c1f1513301e8a1b42005ccc5ac548 \ --hash=sha256:fbeb35a6c3be2c584bfc1d330b7718be0b1d62d5e85f596e60669f126ad7e6a7 # via pypac -idna==3.6 \ - --hash=sha256:9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca \ - --hash=sha256:c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f +idna==3.7 \ + --hash=sha256:028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc \ + --hash=sha256:82fee1fc78add43492d3a1898bfa6d8a904cc97d8427f683ed8e798d07761aa0 # via requests jmespath==1.0.1 \ --hash=sha256:02e2e4cc71b5bcab88332eebf907519190dd9e6e82107fa7f83b1003a6252980 \ @@ -399,9 +399,9 @@ pywin32==301; sys_platform == "win32" \ --hash=sha256:8c9d33968aa7fcddf44e47750e18f3d034c3e443a707688a008a2e52bbef7e96 \ --hash=sha256:595d397df65f1b2e0beaca63a883ae6d8b6df1cdea85c16ae85f6d2e648133fe \ --hash=sha256:87604a4087434cd814ad8973bd47d6524bd1fa9e971ce428e76b62a5e0860fdf -requests==2.31.0 \ - --hash=sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f \ - --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1 +requests==2.32.2 \ + --hash=sha256:dd951ff5ecf3e3b3aa26b40703ba77495dab41da839ae72ef3c8e5d8e2433289 \ + --hash=sha256:fc06670dd0ed212426dfeb94fc1b983d917c4f9847c863f313c9dfaaffb7c23c # via nuxeo send2trash==1.7.1; sys_platform != "darwin" \ --hash=sha256:c20fee8c09378231b3907df9c215ec9766a84ee20053d99fbad854fe8bd42159 \ diff --git a/tools/skiplist.py b/tools/skiplist.py index 57a411e5fd..a828329689 100644 --- a/tools/skiplist.py +++ b/tools/skiplist.py @@ -22,6 +22,7 @@ CliHandler.unbind_server # Used by the arguments parser CustomWindow.keyPressEvent # Called by base class _.close_settings_too # Used by Appiclation.show_filters() +context.minimum_version # Used to set TLS minimum version DirectTransferModel.destination_link # Used in QML DocPair.last_sync_error_date # Check NXDRIVE-1804 Download.transfer_type # Used in QML