Skip to content

Potential fix for code scanning alert no. 5: Uncontrolled data used in path expression #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
johnsamuelwrites wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Potential fix for code scanning alert no. 5: Uncontrolled data used in path expression #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 35 additions & 14 deletions shexstatements/shexfromspreadsheet.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

from os import remove
from os.path import splitext
import tempfile

from odf.opendocument import load
from odf.table import TableCell, TableRow
Expand Down Expand Up @@ -46,13 +47,23 @@ def generate_shex_from_spreadsheet(filepath, skip_header=False, stream=None):

if(file_extension in {".xlsx", ".xlsm", ".xltx", ".xltm"}):
wb = None
temp_path = None
if stream is not None:
with open("tmp" + filepath, "wb") as sf:
sf.write(stream)
sf.close()
filepath = "tmp" + filepath
fd, temp_path = tempfile.mkstemp(suffix=file_extension)
try:
with open(fd, "wb") as sf:
sf.write(stream)
except TypeError:
# Fallback for environments where opening by fd is not supported
import os
os.close(fd)
with open(temp_path, "wb") as sf:
sf.write(stream)
filepath_to_open = temp_path
else:
filepath_to_open = filepath

wb = load_workbook(filepath)
wb = load_workbook(filepath_to_open)
for ws in wb.worksheets:
for i in range(1, ws.max_row+1):
line = list()
Expand All @@ -63,8 +74,8 @@ def generate_shex_from_spreadsheet(filepath, skip_header=False, stream=None):
line = "|".join(line)
data = data + line + "\n"

if stream is not None:
remove(filepath)
if stream is not None and temp_path is not None:
remove(temp_path)

elif(file_extension in {".xls"}):
wb = None
Expand All @@ -84,13 +95,23 @@ def generate_shex_from_spreadsheet(filepath, skip_header=False, stream=None):

elif(file_extension in {".ods"}):
wb = None
temp_path = None
if stream is not None:
with open("tmp" + filepath, "wb") as sf:
sf.write(stream)
sf.close()
filepath = "tmp" + filepath
fd, temp_path = tempfile.mkstemp(suffix=file_extension)
try:
with open(fd, "wb") as sf:
sf.write(stream)
except TypeError:
# Fallback for environments where opening by fd is not supported
import os
os.close(fd)
with open(temp_path, "wb") as sf:
sf.write(stream)
filepath_to_open = temp_path
else:
filepath_to_open = filepath

wb = load(filepath)
wb = load(filepath_to_open)
wb = wb.spreadsheet
rows = wb.getElementsByType(TableRow)
for row in rows:
Expand All @@ -101,8 +122,8 @@ def generate_shex_from_spreadsheet(filepath, skip_header=False, stream=None):
line.append(str(cell))
data = data+"|".join(line) + "\n"

if stream is not None:
remove(filepath)
if stream is not None and temp_path is not None:
remove(temp_path)

shexstatement = CSV.generate_shex_from_data_string(data)
except Exception as e:
Expand Down
Loading