)]}'
{"trove/guestagent/common/sql_query.py":[{"author":{"_account_id":14576,"name":"Petr Malik","email":"pmalik@tesora.com","username":"pmalik"},"change_message_id":"381a98bfad3e125a16ce9f450559b4f30a824136","unresolved":false,"context_lines":[{"line_number":361,"context_line":"                 (\"\u0027%s\u0027@\u0027%s\u0027\" % (self.user, self.host)),"},{"line_number":362,"context_line":"                 (\"\u003d PASSWORD(\u0027%s\u0027)\" % self.clear),"},{"line_number":363,"context_line":"                 ]"},{"line_number":364,"context_line":"        query \u003d [q for q in query if q]"},{"line_number":365,"context_line":"        return \" \".join(query) + \";\""},{"line_number":366,"context_line":""},{"line_number":367,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"fa81d914_5d894dea","line":364,"updated":"2015-01-28 17:21:04.000000000","message":"OK, so what exactly are we doing here? We hardcode a query as a list of parts. Then filter out empty parts (which cannot really be there) and join it back into a single string.\n\nWouldn\u0027t it be better to just define the query as a single format string at the first place and substitute the parameters?","commit_id":"fae4e7b8f1f5b3ccf1a012af8ce27ea8a44e4530"},{"author":{"_account_id":14576,"name":"Petr Malik","email":"pmalik@tesora.com","username":"pmalik"},"change_message_id":"381a98bfad3e125a16ce9f450559b4f30a824136","unresolved":false,"context_lines":[{"line_number":396,"context_line":"        return self.host"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"    def __str__(self):"},{"line_number":399,"context_line":"        query \u003d [\"RENAME USER\","},{"line_number":400,"context_line":"                 self._user_host,"},{"line_number":401,"context_line":"                 \"to\","},{"line_number":402,"context_line":"                 self._set_new_user_host,"}],"source_content_type":"text/x-python","patch_set":11,"id":"fa81d914_bde5e9a9","line":399,"updated":"2015-01-28 17:21:04.000000000","message":"This is like above except it can have empty parts. If that happens we filter them out and produce an invalid SQL.","commit_id":"fae4e7b8f1f5b3ccf1a012af8ce27ea8a44e4530"},{"author":{"_account_id":5293,"name":"Nikhil","email":"SlickNik@gmail.com","username":"slicknik"},"change_message_id":"46a3c9283572c7a80a572f282aa5c4fbd848516a","unresolved":false,"context_lines":[{"line_number":357,"context_line":"        return str(self)"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"    def __str__(self):"},{"line_number":360,"context_line":"        return (\"SET PASSWORD FOR \u0027%s\u0027@\u0027%s\u0027 \u003d PASSWORD(\u0027%s\u0027);\" %"},{"line_number":361,"context_line":"                (self.user, self.host, self.clear))"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"1a6ced46_00d649c5","line":360,"updated":"2015-03-25 08:21:04.000000000","message":"Constructing the queries this way makes it very easy for an attacker to exploit the DB using a SQL injection attack. (The password is user input). I\u0027d suggest using sqlalchemy bind parameters in your queries instead of doing this.","commit_id":"3ee78c24f5ad85f08f0821c69ebf4d8813fd8e10"},{"author":{"_account_id":8151,"name":"Michal Jura","email":"mjura@suse.com","username":"mjura"},"change_message_id":"87169c9001aa0cb51b4518b867598cf01c338a7b","unresolved":false,"context_lines":[{"line_number":357,"context_line":"        return str(self)"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"    def __str__(self):"},{"line_number":360,"context_line":"        return (\"SET PASSWORD FOR \u0027%s\u0027@\u0027%s\u0027 \u003d PASSWORD(\u0027%s\u0027);\" %"},{"line_number":361,"context_line":"                (self.user, self.host, self.clear))"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"fa32b979_0c74f4fa","line":360,"in_reply_to":"1a6ced46_00d649c5","updated":"2015-06-16 14:28:13.000000000","message":"Yes, I agree. We need to do some escaping here. Please use sqlalchemy for it.","commit_id":"3ee78c24f5ad85f08f0821c69ebf4d8813fd8e10"}],"trove/guestagent/datastore/mysql/service.py":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"e80669efc2436bbe36813df3d0bcf25eb48cde40","unresolved":false,"context_lines":[{"line_number":285,"context_line":"                    db_access.add(db_name)"},{"line_number":286,"context_line":"        with LocalSqlClient(get_engine()) as client:"},{"line_number":287,"context_line":"            if user_attrs.get(\u0027password\u0027):"},{"line_number":288,"context_line":"                uu \u003d sql_query.UpdateUser(user.name, host\u003duser.host,"},{"line_number":289,"context_line":"                                          clear\u003duser_attrs.get(\u0027password\u0027))"},{"line_number":290,"context_line":"                t \u003d text(str(uu))"},{"line_number":291,"context_line":"                client.execute(t)"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a890539_fc26d914","line":288,"updated":"2014-12-04 10:46:04.000000000","message":"say what, why UpdateUser if this is a password change?\n\nI\u0027d suggest that maybe this patn isn\u0027t getting tested?","commit_id":"74ea50f52c484c58e8efc9f49ffab3ef53b061f1"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"45d10c7d1fa2f1be6d6fad0393d74b82f7f50ff5","unresolved":false,"context_lines":[{"line_number":282,"context_line":"                                          new_user\u003duser_attrs.get(\u0027name\u0027),"},{"line_number":283,"context_line":"                                          new_host\u003duser_attrs.get(\u0027host\u0027))"},{"line_number":284,"context_line":"            t \u003d text(str(uu))"},{"line_number":285,"context_line":"            client.execute(t)"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"    def create_database(self, databases):"},{"line_number":288,"context_line":"        \"\"\"Create the list of specified databases.\"\"\""}],"source_content_type":"text/x-python","patch_set":13,"id":"da86d52c_54193f78","line":285,"updated":"2015-02-08 11:33:41.000000000","message":"What happens if user renames the user as well as change the password? Is that a possible scenario? In that case, wouldnt it be the rename user query thats get executed? Thanks Sushil.","commit_id":"70b1ecfb3e19bd4aa097bcf83668f0b84768c488"}],"trove/tests/api/users.py":[{"author":{"_account_id":8415,"name":"Denis M.","email":"lildee1991@gmail.com","username":"dmakogon"},"change_message_id":"f328579f4df3acf973f59c1590772dd6e013ddbd","unresolved":false,"context_lines":[{"line_number":471,"context_line":"                fail(\"User %s was not deleted.\" % username)"},{"line_number":472,"context_line":""},{"line_number":473,"context_line":"    @test(depends_on\u003d[test_create_users])"},{"line_number":474,"context_line":"    def test_update_attributes_for_cleared_renamed_user_access(self):"},{"line_number":475,"context_line":"        \"\"\"Verify that when a user\u0027s username is renamed then if someone"},{"line_number":476,"context_line":"        creates same named user the database access are not preserved."},{"line_number":477,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":12,"id":"da86d52c_5655794e","line":474,"updated":"2015-02-03 13:52:03.000000000","message":"One thing, i\u0027d like to figure out, what\u0027s the purpose of running this tests in fake mode? Most of tests that are requiring real MySQL connection (like replication, etc.) are available only in real-mode tests.\n\nSo, please make both this tests available only in real-mode testing.","commit_id":"ac4c284729560cd5309949dab86aff5ebba2d1c3"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"45d10c7d1fa2f1be6d6fad0393d74b82f7f50ff5","unresolved":false,"context_lines":[{"line_number":473,"context_line":"    @test(depends_on\u003d[test_create_users], enabled\u003d(not FAKE))"},{"line_number":474,"context_line":"    def test_update_attributes_for_cleared_renamed_user_access(self):"},{"line_number":475,"context_line":"        \"\"\"Verify that when a user\u0027s username is renamed then if someone"},{"line_number":476,"context_line":"        creates same named user the database access are not preserved."},{"line_number":477,"context_line":"        \"\"\""},{"line_number":478,"context_line":"        databases \u003d [{\"name\": \"myTestDB\"}]"},{"line_number":479,"context_line":"        self.dbaas.databases.create(instance_info.id, databases)"}],"source_content_type":"text/x-python","patch_set":13,"id":"da86d52c_742563ad","line":476,"updated":"2015-02-08 11:33:41.000000000","message":"Sushil, just a recommendation for added clarity: \n\nVerify that when a user\u0027s username is renamed then if someone creates same named user as the original user, the database access are not preserved.\n\nThank you.","commit_id":"70b1ecfb3e19bd4aa097bcf83668f0b84768c488"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"45d10c7d1fa2f1be6d6fad0393d74b82f7f50ff5","unresolved":false,"context_lines":[{"line_number":502,"context_line":"    def test_update_attributes_for_cleared_renamed_host_access(self):"},{"line_number":503,"context_line":"        \"\"\"Verify that when a user\u0027s hostname is edited then if someone creates"},{"line_number":504,"context_line":"        same username and hostname the database access are not preserved."},{"line_number":505,"context_line":"        \"\"\""},{"line_number":506,"context_line":"        orig_usr_name \u003d \u0027testUser\u0027"},{"line_number":507,"context_line":"        usr_new \u003d {\"host\": \"192.168.0.2\"}"},{"line_number":508,"context_line":"        orig_user \u003d {\"name\": orig_usr_name, \"password\": \"password\","}],"source_content_type":"text/x-python","patch_set":13,"id":"da86d52c_942ad77c","line":505,"updated":"2015-02-08 11:33:41.000000000","message":"Same recommendation as above. Thank you.","commit_id":"70b1ecfb3e19bd4aa097bcf83668f0b84768c488"}],"trove/tests/unittests/guestagent/test_dbaas.py":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"e4dee8f46209cc2a28efe2c8db34f7107998a25e","unresolved":false,"context_lines":[{"line_number":487,"context_line":"            self.assertTrue(text in args[0].text, \"%s not in query.\" % text)"},{"line_number":488,"context_line":""},{"line_number":489,"context_line":"    def test_update_attribute_password(self):"},{"line_number":490,"context_line":"        username \u003d \"user1\""},{"line_number":491,"context_line":"        hostname \u003d \"host\""},{"line_number":492,"context_line":"        user_attrs \u003d {\"password\": \u0027testpwd\u0027}"},{"line_number":493,"context_line":"        with patch.object(self.mySqlAdmin, \u0027_get_user\u0027,"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_1dfc483f","line":490,"updated":"2014-12-05 17:30:45.000000000","message":"any reason you need these and can\u0027t use self.mock_user.name?","commit_id":"32129b8e4c6948508a9fac614746bff553ca32f9"}],"trove/tests/unittests/guestagent/test_query.py":[{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"69e83e4e454b3a6864b21b9c96aa8303db12bd52","unresolved":false,"context_lines":[{"line_number":431,"context_line":""},{"line_number":432,"context_line":"class ClearUserAccessTest(QueryTestBase):"},{"line_number":433,"context_line":"    def setUp(self):"},{"line_number":434,"context_line":"        super(UpdateUserTest, self).setUp()"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"    def tearDown(self):"},{"line_number":437,"context_line":"        super(UpdateUserTest, self).tearDown()"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_3665701d","line":434,"updated":"2014-12-01 09:46:46.000000000","message":"The first argument has to be ClearUserAccessTest in this case which is why your tests are failing. Thanks.","commit_id":"c631085b87ebbe6a49de771f678e2515683eec04"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"69e83e4e454b3a6864b21b9c96aa8303db12bd52","unresolved":false,"context_lines":[{"line_number":436,"context_line":"    def tearDown(self):"},{"line_number":437,"context_line":"        super(UpdateUserTest, self).tearDown()"},{"line_number":438,"context_line":""},{"line_number":439,"context_line":"    def test_deafults(self):"},{"line_number":440,"context_line":"        username \u003d \u0027testUser\u0027"},{"line_number":441,"context_line":"        hostname \u003d \u0027localhost\u0027"},{"line_number":442,"context_line":"        uu \u003d sql_query.ClearUserAccess(user\u003dusername, host\u003dhostname)"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_d67fcca9","line":439,"updated":"2014-12-01 09:46:46.000000000","message":"I believe there is a typo here. should be \u0027test_defaults\u0027 instead.","commit_id":"c631085b87ebbe6a49de771f678e2515683eec04"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"69e83e4e454b3a6864b21b9c96aa8303db12bd52","unresolved":false,"context_lines":[{"line_number":443,"context_line":"        self.assertEqual(str(uu), \"DELETE from mysql.db \""},{"line_number":444,"context_line":"                                  \"WHERE User \u003d \u0027testUser\u0027 \""},{"line_number":445,"context_line":"                                  \"AND Host \u003d \u0027localhost\u0027;\")"},{"line_number":446,"context_line":""},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"class DropUserTest(QueryTestBase):"},{"line_number":449,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_f6512831","line":446,"updated":"2014-12-01 09:46:46.000000000","message":"Can you add some more test cases to test cases where username and/or hostname or both are not provided. Thank you","commit_id":"c631085b87ebbe6a49de771f678e2515683eec04"},{"author":{"_account_id":8415,"name":"Denis M.","email":"lildee1991@gmail.com","username":"dmakogon"},"change_message_id":"d3668c53a20bd50fdfaf07d5180ad8affb12f0ce","unresolved":false,"context_lines":[{"line_number":465,"context_line":"        \"\"\"This test tests the exception raised if username and hostname"},{"line_number":466,"context_line":"            are not available for creating the user-access-clear sql."},{"line_number":467,"context_line":"        \"\"\""},{"line_number":468,"context_line":"        self.assertRaises(TypeError, sql_query.ClearUserAccess)"},{"line_number":469,"context_line":""},{"line_number":470,"context_line":""},{"line_number":471,"context_line":"class DropUserTest(QueryTestBase):"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_acbba973","line":468,"updated":"2014-12-02 08:54:28.000000000","message":"all of last three tests can be combined into one test, because they are examining how class constructor works, nothing else.","commit_id":"6f685f2445f08aa24e0c61af51262b624854536d"}]}