From 56a2d78e25bf96b18ce878d8c0cdc4284ecc5a66 Mon Sep 17 00:00:00 2001 From: Santiago Torres Date: Thu, 13 Jun 2019 19:09:49 -0400 Subject: [PATCH 1/5] tracker: add security splash page as index More information on how to submit vulnerablities on arch linux components and infrastructure, as well as how to report issues with packages is necessary to ease the vulnerablity disclosure process. Signed-off-by: Santiago Torres --- tracker/templates/base.html | 3 ++- tracker/templates/home.html | 40 +++++++++++++++++++++++++++++++++++++ tracker/view/__init__.py | 1 + tracker/view/home.py | 8 ++++++++ tracker/view/index.py | 1 - 5 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 tracker/templates/home.html create mode 100644 tracker/view/home.py diff --git a/tracker/templates/base.html b/tracker/templates/base.html index 483fa1da..d9ca9ee6 100644 --- a/tracker/templates/base.html +++ b/tracker/templates/base.html @@ -21,7 +21,8 @@
    -
  • issues
    • +
  • home
    • +
  • issues
  • advisories
  • todo
  • stats
    • diff --git a/tracker/templates/home.html b/tracker/templates/home.html new file mode 100644 index 00000000..5e44d7fc --- /dev/null +++ b/tracker/templates/home.html @@ -0,0 +1,40 @@ +{%- extends "base.html" -%} +{% block content %} + +

    Arch Linux Security

    + + For Arch Linux security is paramount, and a dedicated team of staffers and + volunteers helps with triaging, prioritizing, confirming, patching and + notifying about vulnerabilities in Arch Linux components as well as + packages provided in the official repositories. + +

    Reporting Vulnerablities in Arch Linux Components or Infrastructure

    + + If you have discovered a vulnerability in packages related to core + components or in Arch Linux infrastructure don't hesitate to reach out + to security@archlinux.org to + discuss remediation. You can encrypt your email to the following gpg keys. + +
      +
    • Levente Polyak + E240 B57E 2C46 30BA 768E 2F26 FC1B 547C 8D81 72C8
      • + +
    • Remi Gacogne + A4CB EA79 7489 8599 195E 4FEC 46EC 46F3 9F3E 2EF1
      • + +
    • Allan McRae + 6645 B0A8 C700 5E78 DB1D 7864 F99F FE0F EAE9 99BD
      • +
    + +

    Vulnerabilities in Upstream Packages

    + + Our CVE tracker can help you + review the vulnerabilities that affect the packages we provide. If you + think a CVE that affects a package is not listed in there, do not hesitate + to reach out to us in irc on #archlinux-security. + +

    Securing your Arch Linux installation

    + + Consider checking this + Wiki page for more information +{%- endblock %} diff --git a/tracker/view/__init__.py b/tracker/view/__init__.py index 79cccd9d..e6747a4b 100644 --- a/tracker/view/__init__.py +++ b/tracker/view/__init__.py @@ -5,6 +5,7 @@ from .delete import * from .edit import * from .error import * +from .home import * from .index import * from .login import * from .show import * diff --git a/tracker/view/home.py b/tracker/view/home.py new file mode 100644 index 00000000..5a04e0e2 --- /dev/null +++ b/tracker/view/home.py @@ -0,0 +1,8 @@ +from flask import render_template + +from tracker import tracker + + +@tracker.route('/', methods=['GET']) +def home(): + return render_template('home.html') diff --git a/tracker/view/index.py b/tracker/view/index.py index d6d2d877..fe1ad1b8 100644 --- a/tracker/view/index.py +++ b/tracker/view/index.py @@ -53,7 +53,6 @@ def get_index_data(only_vulnerable=False, only_in_repo=True): return groups -@tracker.route('/', defaults={'path': '', 'only_vulnerable': True}, methods=['GET']) def index(only_vulnerable=True, path=None): groups = get_index_data(only_vulnerable) return render_template('index.html', From 6e01ad046ed9d8854659e682ea22e378889a7f83 Mon Sep 17 00:00:00 2001 From: Santiago Torres Date: Fri, 21 Jun 2019 17:45:14 -0400 Subject: [PATCH 2/5] tracker/view/login: rewire redir index->index_vuln The old behavior that followed a login attempt was to redirect to the index, which used to be the index (equivalent to index_vulnerable). With the new security splash page, this behavior breaks. While it is still up to discussion whether the after-login behavior should be to redirect to the security splash page instead of index_vulnerable, for now we still need to keep the existing behavior. Rewire the redirects on from tracker.index to tracker.index_vulnerable on the login views. Finally, update test_login to reflect this behavior. Signed-off-by: Santiago Torres --- test/test_login.py | 4 ++-- tracker/view/login.py | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/test/test_login.py b/test/test_login.py index 823917ba..908ee97d 100644 --- a/test/test_login.py +++ b/test/test_login.py @@ -51,7 +51,7 @@ def test_login_disabled(db, client): def test_login_logged_in_redirect(db, client): resp = client.post(url_for('tracker.login'), follow_redirects=False) assert 302 == resp.status_code - assert resp.location.endswith('/') + assert resp.location.endswith('/issues') @logged_in @@ -63,4 +63,4 @@ def test_logout(db, client): def test_logout_not_logged_in(db, client): resp = client.post(url_for('tracker.logout'), follow_redirects=False) assert 302 == resp.status_code - assert resp.location.endswith('/') + assert resp.location.endswith('/issues') diff --git a/tracker/view/login.py b/tracker/view/login.py index ea1c8187..b407ae49 100644 --- a/tracker/view/login.py +++ b/tracker/view/login.py @@ -18,7 +18,7 @@ @tracker.route('/login', methods=['GET', 'POST']) def login(): if current_user.is_authenticated: - return redirect(url_for('tracker.index')) + return redirect(url_for('tracker.index_vulnerable')) form = LoginForm() if not form.validate_on_submit(): @@ -33,14 +33,14 @@ def login(): user = user_assign_new_token(form.user) user.is_authenticated = True login_user(user) - return redirect(url_for('tracker.index')) + return redirect(url_for('tracker.index_vulnerable')) @tracker.route('/logout', methods=['GET', 'POST']) def logout(): if not current_user.is_authenticated: - return redirect(url_for('tracker.index')) + return redirect(url_for('tracker.index_vulnerable')) user_invalidate(current_user) logout_user() - return redirect(url_for('tracker.index')) + return redirect(url_for('tracker.index_vulnerable')) From 6b653a12b2452b19822d3e63e36354b2a9f0e6cd Mon Sep 17 00:00:00 2001 From: Santiago Torres Date: Fri, 21 Jun 2019 18:04:51 -0400 Subject: [PATCH 3/5] test: add test_home, refactor test_index test_index used to have a test that targeted the '/' url. Since index does not respond to that url anymore, the test should be removed. Instead, a simpler version of the same test is added on a new module called test_home. Signed-off-by: Santiago Torres --- test/test_home.py | 7 +++++++ test/test_index.py | 8 -------- 2 files changed, 7 insertions(+), 8 deletions(-) create mode 100644 test/test_home.py diff --git a/test/test_home.py b/test/test_home.py new file mode 100644 index 00000000..b229751a --- /dev/null +++ b/test/test_home.py @@ -0,0 +1,7 @@ +from flask import url_for +from werkzeug.exceptions import NotFound + + +def test_home(db, client): + resp = client.get(url_for('tracker.home', path=''), follow_redirects=True) + assert 200 == resp.status_code diff --git a/test/test_index.py b/test/test_index.py index 6f1e64a9..19327945 100644 --- a/test/test_index.py +++ b/test/test_index.py @@ -7,14 +7,6 @@ from .conftest import create_package -@create_package(name='foo', version='1.2.3-4') -@create_group(id=DEFAULT_GROUP_ID, packages=['foo'], affected='1.2.3-3', fixed='1.2.3-4') -def test_index(db, client): - resp = client.get(url_for('tracker.index'), follow_redirects=True) - assert 200 == resp.status_code - assert DEFAULT_GROUP_NAME not in resp.data.decode() - - @create_package(name='foo', version='1.2.3-4') @create_group(id=DEFAULT_GROUP_ID, packages=['foo'], affected='1.2.3-3') def test_index_vulnerable(db, client): From 73455454cf002ce070f1c36075ca23b19cc5ff52 Mon Sep 17 00:00:00 2001 From: Santiago Torres Date: Mon, 29 Jul 2019 19:08:17 -0400 Subject: [PATCH 4/5] templates:home: fix wiki url, mention freenode --- tracker/templates/home.html | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tracker/templates/home.html b/tracker/templates/home.html index 5e44d7fc..34fabbdd 100644 --- a/tracker/templates/home.html +++ b/tracker/templates/home.html @@ -31,10 +31,11 @@

    Vulnerabilities in Upstream Packages

    Our CVE tracker can help you review the vulnerabilities that affect the packages we provide. If you think a CVE that affects a package is not listed in there, do not hesitate - to reach out to us in irc on #archlinux-security. + to reach out to us in irc on #archlinux-security in + freenode.

    Securing your Arch Linux installation

    Consider checking this - Wiki page for more information + Wiki page for more information {%- endblock %} From b0372ae0c815288660cf6010f14c0a125c3d1980 Mon Sep 17 00:00:00 2001 From: Santiago Torres Date: Tue, 9 Mar 2021 12:19:26 -0500 Subject: [PATCH 5/5] templates:home: use url_for for CVE index in home --- tracker/templates/home.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tracker/templates/home.html b/tracker/templates/home.html index 34fabbdd..9c2e2d11 100644 --- a/tracker/templates/home.html +++ b/tracker/templates/home.html @@ -28,7 +28,7 @@

    Reporting Vulnerablities in Arch Linux Components or Infrastructure

    Vulnerabilities in Upstream Packages

    - Our CVE tracker can help you + Our CVE tracker can help you review the vulnerabilities that affect the packages we provide. If you think a CVE that affects a package is not listed in there, do not hesitate to reach out to us in irc on #archlinux-security in