Fixing RO Security Vulnerabilities

[osm/RO.git] / NG-RO / osm_ng_ro / ns.py

diff --git a/NG-RO/osm_ng_ro/ns.py b/NG-RO/osm_ng_ro/ns.py
index 096d4df..102a035 100644 (file)
--- a/NG-RO/osm_ng_ro/ns.py
+++ b/NG-RO/osm_ng_ro/ns.py
@@ -31,6 +31,7 @@ from cryptography.hazmat.primitives import serialization as crypto_serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from jinja2 import (
     Environment,
+    select_autoescape,
     StrictUndefined,
     TemplateError,
     TemplateNotFound,
@@ -77,8 +78,8 @@ def get_process_id():
 
             if text_id:
                 return text_id
-    except Exception:
-        pass
+    except Exception as error:
+        logging.exception(f"{error} occured while getting process id")
 
     # Return a random id
     return "".join(random_choice("0123456789abcdef") for _ in range(12))
@@ -380,7 +381,10 @@ class Ns(object):
             str: [description]
         """
         try:
-            env = Environment(undefined=StrictUndefined)
+            env = Environment(
+                undefined=StrictUndefined,
+                autoescape=select_autoescape(default_for_string=True, default=True),
+            )
             template = env.from_string(cloud_init_content)
 
             return template.render(params or {})
@@ -1087,7 +1091,11 @@ class Ns(object):
 
         # If the position info is provided for all the interfaces, it will be sorted
         # according to position number ascendingly.
-        if all(i.get("position") for i in target_vdu["interfaces"]):
+        if all(
+            i.get("position") + 1
+            for i in target_vdu["interfaces"]
+            if i.get("position") is not None
+        ):
             sorted_interfaces = sorted(
                 target_vdu["interfaces"],
                 key=lambda x: (x.get("position") is None, x.get("position")),
@@ -1097,7 +1105,11 @@ class Ns(object):
         # If the position info is provided for some interfaces but not all of them, the interfaces
         # which has specific position numbers will be placed and others' positions will not be taken care.
         else:
-            if any(i.get("position") for i in target_vdu["interfaces"]):
+            if any(
+                i.get("position") + 1
+                for i in target_vdu["interfaces"]
+                if i.get("position") is not None
+            ):
                 n = len(target_vdu["interfaces"])
                 sorted_interfaces = [-1] * n
                 k, m = 0, 0