Skip to content

TR-13583: Improve TRCLI FieldsParser security by using literal_eval #296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
acuanico-tr-galt merged 3 commits into from
May 7, 2025
Merged

TR-13583: Improve TRCLI FieldsParser security by using literal_eval #296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bc137a0
TR-13583: Improve TRCLI FieldsParser security by using literal_eval
acuanico-tr-galt May 6, 2025
153079f
TR-13583: Added README updates and fix minor old-style tuple expression
acuanico-tr-galt May 6, 2025
92e9764
TR-13583: Remove build check for python 3.8
acuanico-tr-galt May 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/python-app.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:

strategy:
matrix:
python_version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
python_version: ["3.9", "3.10", "3.11", "3.12"]
os: [ubuntu-latest, windows-latest]
runs-on: ${{ matrix.os }}

Expand Down
7 changes: 7 additions & 0 deletions CHANGELOG.MD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ This project adheres to [Semantic Versioning](https://semver.org/). Version numb
- **MINOR**: New features that are backward-compatible.
- **PATCH**: Bug fixes or minor changes that do not affect backward compatibility.

## [1.9.9]

_released 05-06-2025

### Fixed
- Improve security on data parser

## [1.9.8]

_released 10-04-2024
Expand Down
16 changes: 8 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,8 @@ trcli
```
You should get something like this:
```
TestRail CLI v1.9.8
Copyright 2024 Gurock Software GmbH - www.gurock.com
TestRail CLI v1.9.9
Copyright 2025 Gurock Software GmbH - www.gurock.com
Supported and loaded modules:
- parse_junit: JUnit XML Files (& Similar)
- parse_robot: Robot Framework XML Files
Expand All @@ -45,8 +45,8 @@ CLI general reference
--------
```shell
$ trcli --help
TestRail CLI v1.9.8
Copyright 2024 Gurock Software GmbH - www.gurock.com
TestRail CLI v1.9.9
Copyright 2025 Gurock Software GmbH - www.gurock.com
Usage: trcli [OPTIONS] COMMAND [ARGS]...

TestRail CLI
Expand Down Expand Up @@ -264,8 +264,8 @@ will be used to upload all results into the same test run.
### Reference
```shell
$ trcli add_run --help
TestRail CLI v1.9.8
Copyright 2024 Gurock Software GmbH - www.gurock.com
TestRail CLI v1.9.9
Copyright 2025 Gurock Software GmbH - www.gurock.com
Usage: trcli add_run [OPTIONS]

Options:
Expand Down Expand Up @@ -303,8 +303,8 @@ providing you with a solid base of test cases, which you can further expand on T
### Reference
```shell
$ trcli parse_openapi --help
TestRail CLI v1.9.8
Copyright 2024 Gurock Software GmbH - www.gurock.com
TestRail CLI v1.9.9
Copyright 2025 Gurock Software GmbH - www.gurock.com
Usage: trcli parse_openapi [OPTIONS]

Parse OpenAPI spec and create cases in TestRail
Expand Down
2 changes: 1 addition & 1 deletion trcli/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "1.9.8"
__version__ = "1.9.9"
2 changes: 1 addition & 1 deletion trcli/constants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@
)

TOOL_VERSION = f"""TestRail CLI v{trcli.__version__}
Copyright 2024 Gurock Software GmbH - www.gurock.com"""
Copyright 2025 Gurock Software GmbH - www.gurock.com"""
TOOL_USAGE = f"""Supported and loaded modules:
- parse_junit: JUnit XML Files (& Similar)
- parse_robot: Robot Framework XML Files
Expand Down
10 changes: 5 additions & 5 deletions trcli/data_classes/data_parsers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import re
from beartype.typing import Union, List, Dict
import re, ast
from beartype.typing import Union, List, Dict, Tuple


class MatchersParser:
Expand All @@ -9,7 +9,7 @@ class MatchersParser:
PROPERTY = "property"

@staticmethod
def parse_name_with_id(case_name: str) -> (int, str):
def parse_name_with_id(case_name: str) -> Tuple[int, str]:
"""Parses case names expecting an ID following one of the following patterns:
- "C123 my test case"
- "my test case C123"
Expand Down Expand Up @@ -49,7 +49,7 @@ def parse_name_with_id(case_name: str) -> (int, str):
class FieldsParser:

@staticmethod
def resolve_fields(fields: Union[List[str], Dict]) -> (Dict, str):
def resolve_fields(fields: Union[List[str], Dict]) -> Tuple[Dict, str]:
error = None
fields_dictionary = {}
try:
Expand All @@ -58,7 +58,7 @@ def resolve_fields(fields: Union[List[str], Dict]) -> (Dict, str):
field, value = field.split(":", maxsplit=1)
if value.startswith("["):
try:
value = eval(value)
value = ast.literal_eval(value)
except Exception:
pass
fields_dictionary[field] = value
Expand Down