Snyk Finding for python "future" package

[nickumia-reisys]

Please keep any sensitive details in Google Drive.

Date of report: 01/03/2023
Severity: High
Due date: 02/03/2023

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

• Analysis has been performed and an issue has been linked to address other occurrences for this class of vulnerability* (link)

* When a finding is identified, we create two issues. One to address the specific instance identified in the report. The other is to identify and address all other occurrences of this vulnerability within the application.

Brief description

[nickumia-reisys]

For whoever picks this up, my speculative judgement on this makes me believe we are not vulnerable since future is a py2-compatibility library. As we are fully on py3, the future aspects of the CKAN codebase are not being activated and, thus not vulnerable. It might be very hard to validate this in all cases since future has 100s of references throughout the code. Although after writing this, we might be able to get rid of future as it isn't included in our inventory build. It might just be included because of some upstream extension on catalog that isn't on inventory.

It just good due diligence to fix this, but I can't say I'm up for the job right now.

[FuhuXia]

Without removing the 100s references, The minimum thing we can do is adding a condition for the all the import future statement we can find and make sure they only happen in python 2.7 environment, therefore we can claim we are not affected.

[nickumia-reisys]

I think adding the condition is counter-intuitive for what future is supposed to do. future itself is assessing python version and running the appropriate code. If we wrap future in a conditional, it would just be a redundant check, no?

[FuhuXia]

Adding the condition will make sure future not imported in our app so we can remove it from the pip requirements, therefore silence the synk report.

[FuhuXia]

RP submitted to remove future dependency in ckanext-archiver. ckan/ckanext-archiver#88

But then, future is patched, https://pypi.org/project/future/0.18.3/

[FuhuXia]

Patched and deployed to catalog.