pulp / pulp/pulp-cli

The command `pulp vulnerability-report show --href` accepts any href

Open
#1,429 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Triage-Needed
Dominant language
Python
Stars
43
Forks
52
Avg merge
11h 38m
Merged PRs (30d)
11

Description

Summary

The command effectively acts like the pulp show --href, accepting any kind of href.

I found that because pulp_python vuln report test does that (takes a task where it really wanted to take a vulnerability report). Tested with a few other resources and concluded it can take anything.

Steps to reproduce

# grab a task (there is usually one available)
TASK_HREF=$(pulp task list | jq -r '.[0].pulp_href')

# show task info with vuln report command
pulp vulnerability-report show --href "$TASK_HREF"

Expected behavior

It should error for resources which are not vulnerability reports.

Stacktrace/Error log

No applicable.

Pulp and pulp-cli version info

$ pulp --version
Pulp3 Command Line Interface, Version 0.40.0
Plugin Versions:
  common: 0.40.0

$ pulp status
{
  "versions": [
    {
      "component": "core",
      "version": "3.113.0.dev",
      "package": "pulpcore",
      "module": "pulpcore.app",
      "domain_compatible": true
    },
    {
      "component": "certguard",
      "version": "3.113.0.dev",
      "package": "pulpcore",
      "module": "pulp_certguard.app",
      "domain_compatible": true
    },
    {
      "component": "file",
      "version": "3.113.0.dev",
      "package": "pulpcore",
      "module": "pulp_file.app",
      "domain_compatible": true
    },
    {
      "component": "python",
      "version": "3.32.0.dev",
      "package": "pulp-python",
      "module": "pulp_python.app",
      "domain_compatible": true
    },
    {
      "component": "rpm",
      "version": "3.38.0.dev",
      "package": "pulp-rpm",
      "module": "pulp_rpm.app",
      "domain_compatible": true
    }
  ],
(...)

Additional context

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the implementation of pulp vulnerability-report show --href and compare it with the pulp_python vulnerability-report test mentioned in the issue. Reproduce with a task href from pulp task list, then verify that non-vulnerability-report resources are rejected while vulnerability-report hrefs still work.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.