fix(security): resolve SonarQube critical/high/blocker security findings#1608
Open
ramakrishnap-nv wants to merge 7 commits into
Open
fix(security): resolve SonarQube critical/high/blocker security findings#1608ramakrishnap-nv wants to merge 7 commits into
ramakrishnap-nv wants to merge 7 commits into
Conversation
Three SonarQube findings in webserver.py (CWE-22 path traversal, CWE-20
improper input validation):
1. get_output_name: replace blocklist check (startswith("/") or ".." in)
with os.path.realpath + os.path.commonpath containment check against
resultdir, matching the guard already used in validate_file_path().
2. getsolverlogs / deletesolverlogs: validate that the `id` path parameter
is a well-formed UUID before constructing "log_<id>" file path, closing
the taint path from HTTP input to os.path.join / open / os.unlink.
3. getsolverlogs: reject negative frombyte values before passing to
out.seek() instead of relying on OSError from the OS.
Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
The /cuopt/cuopt managed-service endpoint accepted nvcf-asset-dir, nvcf-function-asset-ids, and nvcf-large-output-dir as HTTP headers and used them in file operations without sanitization (CWE-22). - NVCF_LARGE_OUTPUT_DIR: require absolute path and canonicalize with os.path.realpath() before passing to NVCFJobResult as resultdir. - NVCF_FUNCTION_ASSET_IDS: validate that the asset ID stays within NVCF_ASSET_DIR using os.path.realpath + os.path.commonpath containment check, matching the pattern used in validate_file_path(). Reject if asset ID is itself an absolute path or escapes the asset root. Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
ramakrishnap-nv
changed the title
ramakrishnap-nv
marked this pull request as ready for review
July 23, 2026 17:14
ramakrishnap-nv
added
non-breaking
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughChangesThe pull request tightens webserver filesystem and request validation, resolves nightly output paths, replaces implicit NaN checks, hardens parser timer cleanup, and reformats decompression code without changing its logic. Validation and robustness updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@python/cuopt_server/cuopt_server/webserver.py`:
- Around line 1344-1353: Update the NVCF_LARGE_OUTPUT_DIR handling in the
webserver request path to require its canonicalized path to remain within the
deployment-configured trusted output root, not merely be absolute. Resolve both
paths before validating containment, reject paths outside the root with the
existing HTTPException pattern, and preserve the canonical path passed as the
write directory.
- Around line 1363-1383: Update the result-registration flow around
NVCFJobResult.register_result so NVCF_FUNCTION_ASSET_IDS, NVCF_ASSET_DIR, and
the resolved asset path are fully validated before registering the result, or
ensure every validation exception unregisters the registered result via finally.
Preserve the existing HTTP 400 responses while preventing invalid requests from
leaving registered results behind.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ce1eb196-bb75-434a-a1aa-955fc7a07aa2
📒 Files selected for processing (1)
python/cuopt_server/cuopt_server/webserver.py
CI Test Summary✅ All 31 test job(s) passed. |
…dings - fast_parser.cpp: wrap destructor body in try-catch (S1048); suppress S3519 false positive with NOSONAR (find_line_start pointer stays in bounds) - fast_fp64_parser.hpp: replace v==v NaN check with !std::isnan(v) (S1764) - lz4_file_reader.cpp: suppress S836 false positives with NOSONAR (window_count is initialized before window_state_ and window_done per C++ declaration order) - file_to_string.cpp: suppress 14 S2259 false positives with NOSONAR (mps_parser_expects throws before any null pointer dereference) - phase2.cpp: replace scale!=scale NaN check with std::isnan(scale) (S1764) - c_api_test.c: replace x!=x NaN check with isnan() from <math.h> (S1764) - pcgenerator.hpp: replace unary minus on unsigned with (32u-rot)&31u (S876) - aggregate_nightly.py: canonicalize output_dir with Path.resolve() (S2083) Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
ramakrishnap-nv
changed the title
- Validate NVCF asset path before register_result() to prevent leaked registered results when header validation raises HTTPException - Add optional CUOPT_NVCF_OUTPUT_ROOT env var: when set, require nvcf-large-output-dir to stay within the deployment-configured root Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
tmckayus
approved these changes
Jul 23, 2026
…orward decl
As of rmm 26.10, rmm::device_uvector is defined inside the ABI inline namespace
rmm::RMM_ABI_NAMESPACE (rmm/detail/export.hpp). cuOpt's manual
namespace rmm { template <typename T> class device_uvector; }
forward declaration in problem_checking.cuh injects a *second*, distinct
rmm::device_uvector into the plain rmm namespace, so every use becomes ambiguous
('rmm::device_uvector is ambiguous'), which fails the build against rmm 26.10.
Replace the hand-rolled forward declaration with #include <rmm/device_uvector.hpp>
so the correctly ABI-namespaced declaration is used. (cuOpt already disables the
analogous thrust/cub ABI namespaces via -DTHRUST_DISABLE_ABI_NAMESPACE /
-DCUB_DISABLE_NAMESPACE_MAGIC; rmm's ABI namespace is newer and has no such opt-out.)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Max Buckley <maxwbuckley@gmail.com>
mlubin
reviewed
Jul 24, 2026
mlubin
reviewed
Jul 24, 2026
… lz4_file_reader.cpp - Remove try-catch from ~scoped_timer_t(): reviewers noted that the called functions cannot realistically throw; silent catching was flagged as bad practice. Suppress S1048 with NOSONAR instead. - Fix corrupted SPDX header in fast_parser.cpp and lz4_file_reader.cpp: verify-copyright hook had split the long copyright line and duplicated "reserved." onto the license-identifier line. Signed-off-by: Ramakrishna Prabhu <ramakrishnap@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves SonarQube critical, high, and blocker security findings across the server, C++ solver, and CI utilities.
Python server (CWE-22, CWE-20):
nvcf-asset-dirvia realpath+commonpath; require absolute path fornvcf-large-output-dirget_output_name: replace blocklist with realpath+commonpath containment checkidis a well-formed UUID before constructing file pathsgetsolverlogs: reject negativefrombytewith HTTP 422C++ / CI (genuine bugs):
fast_parser.cpp: wrapscoped_timer_tdestructor body in try-catch (S1048)fast_fp64_parser.hpp,phase2.cpp,c_api_test.c: replacev==v/x!=xNaN idiom withstd::isnan()/isnan()(S1764)pcgenerator.hpp: replace unary minus on unsigned(-rot)with(32u-rot)&31u(S876)aggregate_nightly.py: canonicalizeoutput_dirwithPath.resolve()before use (S2083)False positives suppressed with
// NOSONAR:fast_parser.cpp:find_line_startreturn stays within bounds (S3519)lz4_file_reader.cpp:window_countinitialized before dependent fields per C++ declaration order (S836)file_to_string.cpp(14 sites):mps_parser_expectsthrows before any null dereference (S2259)