Mercurial > p > roundup > code
view .codecov.yml @ 5924:b40059d7036f
issue2550925 strip HTTP_PROXY environment variable
if deployed as CGI and client sends an http PROXY
header, the tainted HTTP_PROXY environment variable is created. It
can affect calls using requests package or curl. A roundup admin
would have to write detectors/extensions that use these mechanisms.
Not exploitable in default config.
See: https://httpoxy.org/
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sun, 13 Oct 2019 17:45:06 -0400 |
| parents | c3ffa1ef6b7f |
| children | 5f0463897afc |
line wrap: on
line source
# - "path/to/folder" # ignore folders and all its contents # - "test_*.rb" # wildcards accepted # - "**/*.py" # glob accepted # - "[a-z]+/test_.*" # regexp accepted # ignore files that are build utils and not executed # code, or are deprecated. ignore: - "roundup/cgi/TAL/talgettext.py" # utility command - "roundup/cgi/TAL/DummyEngine.py" # test harness - "roundup/cgi/apache.py" # mod_python is deprecated - "roundup/install_util.py" # another build utlity - "roundup/dist" # more build utils