MPT-6785 Sync upstream/2025041101-public -> main 2025-04-14 #107
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
…ancers recommendation - Updated ResourceMetrics component to include new metrics: bytes sent and packets sent. - Improved loading state handling in ResourceMetrics - Added support for the "Abandoned Load Balancers" recommendation - Introduced AbandonedLoadBalancers modal and associated components for managing load balancer thresholds. - Added new constants and chart properties for bytes and packets sent metrics. - Updated translations for new features and metrics.
…urce page (#1466) ## Description The "Add Data Source" page description added.
…Comparison page (#1464) ## Description Cloud cost comparison page description added.
…olidated "Disk I/O" metrics - Added new metrics for Disk I/O usage and consolidated Disk I/O in ResourceMetrics component. - Updated chart properties and constants to support new metrics.
…ization data loading
…esBarChart component
…. (#1467) ## Description The 'Events' page description added to community doc.
## Description configure_custom_email_templates.md file added.
- Introduced a new field for maximum runset runners in the MlRunsetTemplate component. - Updated related components and forms to handle the new maximum runset runners parameter. - Updated translations to include the new label for maximum runset runners.
41e253e OSN-769. Fixed not cleaning filebeat indices in cleanelkdb 4ec352e OSN-756. Update vite related dependencies 6660c5e OSN-751. Fix request parameters to retrieve a run on the Add Artifact page 0aceba6 OSN-720. Transpose ComparisonTable e36fa4a OSN-670. [OptScale][Community Documentation] Add tips for Events page.
8ba09ef OSN-704. Updated custom email templates link 440fa82 OSN-751. Fix request parameters to retrieve a run on the Edit run artifact page 8d15527 OSN-658. Support max runner number in runset template fa9d696 OSN-771. Add maximum runset runners feature to MlRunsetTemplate e64df14 OSN-704. Add Custom email templates instruction
## Description Instructions update.
- Changed 'startFrom' to 'offset' in action creators, service types, and container to standardize pagination parameters.
…n theme settings. (#1484) ## Description OSN-721. theme_settings.md page added.
…ndations page - Updated the disabled state condition for the force check button to ensure it is only enabled when force check is available.
Refactor the form structure by displaying only cloud types in the cards. Subtypes are moved inside the form instead of being displayed on the main page.
* Added new fields to Azure subscription configuration, including export_name, container, directory, and support for billing export. * Updated forms and GraphQL schemas to accommodate these changes
- Modified links in email templates to append organization ID as a query parameter. - Updated the HeraldExecutorWorker to pass the organization ID when generating constraint links.
## Checklist * [ ] The pull request title is a good summary of the changes * [ ] Unit tests for the changes exist * [ ] New and existing unit tests pass locally
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bandit found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
| @staticmethod | ||
| def _detect_billing_period(report_path): | ||
| billing_period = report_path.split('/')[-2] | ||
| LOG.info('detected billing period: %s', billing_period) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the issue, we should avoid logging the billing_period directly. Instead, we can log a generic or sanitized message that does not expose sensitive details. If logging the billing_period is necessary for debugging or operational purposes, we should ensure it is sanitized or masked before logging. Alternatively, we can remove the log statement entirely if it is not critical.
Suggested changeset
1
diworker/diworker/importers/azure_export.py
| @@ -121,3 +121,4 @@ | ||
| billing_period = report_path.split('/')[-2] | ||
| LOG.info('detected billing period: %s', billing_period) | ||
| sanitized_billing_period = "[REDACTED]" # Mask sensitive data | ||
| LOG.info('detected billing period: %s', sanitized_billing_period) | ||
|
|
Copilot is powered by AI and may make mistakes. Always verify output.
| else: | ||
| billing_info = self._retry(self._get_billing_info) | ||
| LOG.info('Billing info for subscription %s: %s', | ||
| self._subscription_id, billing_info) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the issue, we will sanitize the billing_info dictionary before logging it. Specifically, we will redact or exclude sensitive fields such as billing_currency from the log output. This ensures that no sensitive information is exposed in the logs while still allowing non-sensitive data to be logged for debugging or informational purposes.
Steps to implement the fix:
- Identify the sensitive fields in the
billing_infodictionary (e.g.,billing_currency). - Create a sanitized version of the dictionary by redacting or removing sensitive fields.
- Log the sanitized dictionary instead of the original
billing_info.
Suggested changeset
1
tools/cloud_adapter/clouds/azure.py
| @@ -607,4 +607,6 @@ | ||
| billing_info = self._retry(self._get_billing_info) | ||
| sanitized_billing_info = {k: (v if k != 'currency' else 'REDACTED') | ||
| for k, v in billing_info.items()} | ||
| LOG.info('Billing info for subscription %s: %s', | ||
| self._subscription_id, billing_info) | ||
| self._subscription_id, sanitized_billing_info) | ||
|
|
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR syncs the latest changes from upstream.