Prevents delegate role name as top-level role name #1690

kairoaraujo · 2021-11-22T15:46:40Z

This commit adds the validation in the metadata.Delegations
to prevent that one of the delegate role names given is a top-level
role name.

A ValueError will be raised if one of the roles names in the
the list given to as delegated contains the role name as one of the
top-level roles.

The mirrors role is not covered in this PR.

Signed-off-by: Kairo de Araujo kdearaujo@vmware.com

Please fill in the fields below to submit a pull request. The more information
that is provided, the better.

Fixes #1558

Description of the changes being introduced by the pull request:

Please verify and check that the pull request fulfills the following
requirements:

The code follows the Code Style Guidelines
Tests have been added for the bug fix or new feature
Docs have been added for the bug fix or new feature

This commit adds the validation in the ``metadata.Delegations`` to prevent that one of the delegate role names given is a top-level role name. A ``ValueError`` will be raised if one of the roles names in the list given to as delegated contains the role name as one of the top-level roles. Signed-off-by: Kairo de Araujo <kdearaujo@vmware.com>

coveralls · 2021-11-22T16:10:36Z

Pull Request Test Coverage Report for Build 1516182630

2 of 2 (100.0%) changed or added relevant lines in 1 file are covered.
7 unchanged lines in 2 files lost coverage.
Overall coverage increased (+0.1%) to 97.581%

Files with Coverage Reduction	New Missed Lines	%
tuf/api/metadata.py	1	98.1%
tuf/ngclient/updater.py	6	95.3%

Totals
Change from base Build 1490568233:	0.1%
Covered Lines:	4032
Relevant Lines:	4116

💛 - Coveralls

MVrachev

Thank you @kairoaraujo for your pr and effort!
There are a couple of things to fix, but it's a great start.

Please note that at the current stage mirrors won't be implemented in the new implementation. For more reference read the second point from issue #1317.

tests/test_metadata_serialization.py

MVrachev · 2021-11-22T16:26:37Z

tests/test_metadata_serialization.py

@@ -360,6 +360,43 @@ def test_delegation_serialization(self, test_case_data: str):
        delegation = Delegations.from_dict(copy.deepcopy(case_dict))
        self.assertDictEqual(case_dict, delegation.to_dict())

+    valid_delegations: utils.DataSet = {


Can you please use the dataset defined at line 321

python-tuf/tests/test_metadata_serialization.py

Line 321 in acb201d

invalid_delegations: utils.DataSet = {

and the test function defined in 336

python-tuf/tests/test_metadata_serialization.py

Line 336 in acb201d

def test_invalid_delegation_serialization(self, test_case_data: str):

instead of defining a valid_delegations and a new test function?

We aim to group all valid tests related to a specific class in one dataset and test function.
Also, the name valid_delegations is not correct.
Those are actually cases of invalid_delegations as when you call Delegations.from_dict(copy.deepcopy(case_dict)) it causes ValueError as you catch it inside your the test function.

I have a concern about how to make sure that the ValueError is the correct unit we want.
I mean, we test the ValueError raised, but we don't check if the message comes from the part we want to cover.
Unless we don't want to go deep in this level, it is ok.

I think this is a more general question that probably is worth adressing.
I think for sure we want to have all invalid tests for Delegations in one single place, but I understand what you mean.
Maybe we can check the error message and type inside the with?
What do you think @jku?

Yes, indeed. If agreed in checking the type and error message, we can address it in another issue.

tests/test_metadata_serialization.py

tuf/api/metadata.py

- Reuse the dataset and the existing tests - Fix the keyids in the tests datasets to be aligned - Fix the ``ValueError`` message aligned to the existent messages Signed-off-by: Kairo de Araujo <kdearaujo@vmware.com>

sechkova · 2021-11-24T11:00:24Z

The issue discussion mentions also preventing delegated roles from being empty strings. Do you mind adding this check as part of this PR? Sorry if it's been done already somewhere and I've missed that.

- Add the check for empty strings in the Delegate Role name - Remove the comprehensive lists to make the code more readable - Remove the test for empty file name from ``test_updater_with_simulator`` Signed-off-by: Kairo de Araujo <kdearaujo@vmware.com>

MVrachev · 2021-11-24T19:03:23Z

tuf/api/metadata.py

+        for role in set(roles):
+            if not role or role in TOP_LEVEL_ROLE_NAMES:
+                raise ValueError(
+                    "Delegated roles cannot be empty or use top-level role names"
+                )


You still can write the check as a one-line like this:

Suggested change

for role in set(roles):

if not role or role in TOP_LEVEL_ROLE_NAMES:

raise ValueError(

"Delegated roles cannot be empty or use top-level role names"

)

if any(not role or role in TOP_LEVEL_ROLE_NAMES for role in set(roles)):

raise ValueError(

"Delegated roles cannot be empty or use top-level role names"

)

and I personally prefer it.
@sechkova what do you think?

Yes, I had a small talk with @jku, and we came out about making it more readable. I'm open about any option 🙂

Thanks for adding the check, I agree that separate lines are more readable.

set() does not seem necessary?

MVrachev · 2021-11-24T19:09:13Z

@sechkova can you approve running the CI workflows as GitHub says that:
First-time contributors need a maintainer to approve running workflows.

sechkova

I don't know if @MVrachev has any more comments, looks ok to me.

MVrachev · 2021-11-26T08:59:50Z

Thanks for asking.
I don't have any other comments.
LGTM!

jku

LGTM, but there does seem to be an unnecessary set construction in there

jku · 2021-11-29T09:59:50Z

tuf/api/metadata.py

+        for role in set(roles):
+            if not role or role in TOP_LEVEL_ROLE_NAMES:
+                raise ValueError(
+                    "Delegated roles cannot be empty or use top-level role names"
+                )


set() does not seem necessary?

The set() is not required in the OrderedDict. Signed-off-by: Kairo de Araujo <kdearaujo@vmware.com>

jku · 2021-11-29T13:53:03Z

Thanks!

MVrachev suggested changes Nov 22, 2021

View reviewed changes

Fix reuse datasets/tests, better keyids, standards

597fc88

- Reuse the dataset and the existing tests - Fix the keyids in the tests datasets to be aligned - Fix the ``ValueError`` message aligned to the existent messages Signed-off-by: Kairo de Araujo <kdearaujo@vmware.com>

MVrachev reviewed Nov 24, 2021

View reviewed changes

sechkova reviewed Nov 25, 2021

View reviewed changes

sechkova approved these changes Nov 26, 2021

View reviewed changes

jku reviewed Nov 29, 2021

View reviewed changes

Remove the unnecessary set()

72d68f3

The set() is not required in the OrderedDict. Signed-off-by: Kairo de Araujo <kdearaujo@vmware.com>

jku merged commit 2de883a into theupdateframework:develop Nov 29, 2021

lukpueh mentioned this pull request Dec 13, 2021

Prepare v0.20.0 #1723

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prevents delegate role name as top-level role name #1690

Prevents delegate role name as top-level role name #1690

kairoaraujo commented Nov 22, 2021

coveralls commented Nov 22, 2021 •

edited

Loading

MVrachev left a comment

MVrachev Nov 22, 2021

kairoaraujo Nov 23, 2021

MVrachev Nov 23, 2021 •

edited

Loading

kairoaraujo Nov 23, 2021

sechkova commented Nov 24, 2021

MVrachev Nov 24, 2021 •

edited

Loading

kairoaraujo Nov 25, 2021

sechkova Nov 25, 2021

jku Nov 29, 2021

MVrachev commented Nov 24, 2021

sechkova left a comment

MVrachev commented Nov 26, 2021

jku left a comment

jku Nov 29, 2021

jku commented Nov 29, 2021

Prevents delegate role name as top-level role name #1690

Prevents delegate role name as top-level role name #1690

Conversation

kairoaraujo commented Nov 22, 2021

coveralls commented Nov 22, 2021 • edited Loading

Pull Request Test Coverage Report for Build 1516182630

💛 - Coveralls

MVrachev left a comment

Choose a reason for hiding this comment

MVrachev Nov 22, 2021

Choose a reason for hiding this comment

kairoaraujo Nov 23, 2021

Choose a reason for hiding this comment

MVrachev Nov 23, 2021 • edited Loading

Choose a reason for hiding this comment

kairoaraujo Nov 23, 2021

Choose a reason for hiding this comment

sechkova commented Nov 24, 2021

MVrachev Nov 24, 2021 • edited Loading

Choose a reason for hiding this comment

kairoaraujo Nov 25, 2021

Choose a reason for hiding this comment

sechkova Nov 25, 2021

Choose a reason for hiding this comment

jku Nov 29, 2021

Choose a reason for hiding this comment

MVrachev commented Nov 24, 2021

sechkova left a comment

Choose a reason for hiding this comment

MVrachev commented Nov 26, 2021

jku left a comment

Choose a reason for hiding this comment

jku Nov 29, 2021

Choose a reason for hiding this comment

jku commented Nov 29, 2021

coveralls commented Nov 22, 2021 •

edited

Loading

MVrachev Nov 23, 2021 •

edited

Loading

MVrachev Nov 24, 2021 •

edited

Loading