PPS-204 Update dependencies (#389)

Dockerfile

@@ -50,10 +50,10 @@ RUN poetry config virtualenvs.create false \
 # copy source code ONLY after installing dependencies
 COPY . /$appname
 COPY ./deployment/uwsgi/uwsgi.ini /etc/uwsgi/uwsgi.ini
-COPY ./bin/settings.py /var/www/sheepdog/settings.py
-COPY ./bin/confighelper.py /var/www/sheepdog/confighelper.py
+COPY ./bin/settings.py /var/www/$appname/settings.py
+COPY ./bin/confighelper.py /var/www/$appname/confighelper.py
 
-# install indexd
+# install sheepdog
 RUN poetry config virtualenvs.create false \
     && poetry install -vv --no-dev --no-interaction \
     && poetry show -v

sheepdog/blueprint/routes/views/__init__.py

@@ -2,6 +2,8 @@
 Provide view functions for routes in the blueprint.
 """
 
+import html
+
 import flask
 from flask import current_app
 import uuid
@@ -226,7 +228,7 @@ def get_templates():
     Responses:
         200: Success.
     """
-    file_format = flask.request.args.get("format", "tsv")
+    file_format = html.escape(flask.request.args.get("format", "tsv"))
     response = flask.make_response(
         utils.get_all_template(
             file_format,

sheepdog/blueprint/routes/views/program/project.py

@@ -5,6 +5,7 @@
 View functions for routes in the blueprint for '/<program>/<project>' paths.
 """
 
+import html
 import json
 
 import flask
@@ -617,7 +618,7 @@ def get_manifest(program, project):
         raise UserError(
             "No ids specified. Use query parameter 'ids', e.g." " 'ids=id1,id2'."
         )
-    requested_ids = id_string.split(",")
+    requested_ids = html.escape(id_string).split(",")
     docs = utils.manifest.get_manifest(program, project, requested_ids)
     response = flask.make_response(
         yaml.safe_dump({"files": docs}, default_flow_style=False)
@@ -817,7 +818,7 @@ def get_project_templates(program, project):
         file_format,
         program=program,
         project=project,
-        categories=flask.request.args.get("categories"),
+        categories=html.escape(flask.request.args.get("categories")),
         exclude=flask.request.args.get("exclude"),
     )
     response = flask.make_response(template)

sheepdog/utils/__init__.py

@@ -8,6 +8,7 @@
 import copy
 import csv
 import functools
+import html
 import json
 import os
 import io
@@ -451,7 +452,9 @@ def proxy_request(project_id, uuid, data, args, headers, method, action, dry_run
 
         update_file_record_url(file_record, s3_url=new_url)
         update_state(node, SUCCESS_STATE)
-        message = "URL successfully reassigned. New url: {}".format(new_url)
+        message = "URL successfully reassigned. New url: {}".format(
+            html.escape(new_url)
+        )
         return flask.Response(json.dumps({"message": message}), status=200)
 
     resp = s3.make_s3_request(project_id, uuid, data, args, headers, method, action)

tests/integration/datadict/test_ssl_and_isolation_level.py

@@ -17,24 +17,28 @@
 ISOLATION_LEVELS = ["READ_COMMITTED", "REPEATABLE_READ", "SERIALIZABLE", None]
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_post_example_entities_together(client, pg_driver, cgci_blgsp, submitter):
     do_test_post_example_entities_together(client, submitter)
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_delete_entity(client, pg_driver, cgci_blgsp, submitter):
     do_test_delete_entity(client, submitter)
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_submit_valid_tsv(client, pg_driver, cgci_blgsp, submitter):
     do_test_submit_valid_tsv(client, submitter)
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_export_all_node_types(

tests/integration/datadictwithobjid/test_ssl_and_isolation_level.py

@@ -19,24 +19,28 @@
 ISOLATION_LEVELS = ["READ_COMMITTED", "REPEATABLE_READ", "SERIALIZABLE", None]
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_post_example_entities_together(client, pg_driver, cgci_blgsp, submitter):
     do_test_post_example_entities_together(client, submitter)
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_delete_entity(client, pg_driver, cgci_blgsp, submitter):
     do_test_delete_entity(client, submitter)
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_submit_valid_tsv(client, pg_driver, cgci_blgsp, submitter):
     do_test_submit_valid_tsv(client, submitter)
 
 
+@pytest.mark.ssl
 @pytest.mark.parametrize("use_ssl", USE_SSL, indirect=True)
 @pytest.mark.parametrize("isolation_level", ISOLATION_LEVELS, indirect=True)
 def test_export_all_node_types(