-
Notifications
You must be signed in to change notification settings - Fork 361
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
65 changed files
with
1,014 additions
and
436 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
centaur/src/main/resources/standardTestCases/hello_private_repo.test
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| name: hello_private_repo | ||
| testFormat: runtwiceexpectingcallcaching | ||
| backends: [LocalDockerSecure] | ||
|
|
||
| files { | ||
| workflow: hello_private_repo/hello_private_repo.wdl | ||
| inputs: hello_private_repo/hello_private_repo.inputs.json | ||
| } | ||
|
|
||
| metadata { | ||
| workflowName: hello_private_repo | ||
| status: Succeeded | ||
| "calls.hello_private_repo.hello.callCaching.result": "Cache Hit: <<CACHE_HIT_UUID>>:hello_private_repo.hello:-1" | ||
| } | ||
|
|
3 changes: 3 additions & 0 deletions
3
...ur/src/main/resources/standardTestCases/hello_private_repo/hello_private_repo.inputs.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| { | ||
| "hello_private_repo.addressee": "m'Lord" | ||
| } |
27 changes: 27 additions & 0 deletions
27
centaur/src/main/resources/standardTestCases/hello_private_repo/hello_private_repo.wdl
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| version 1.0 | ||
|
|
||
| task hello { | ||
| input { | ||
| String addressee | ||
| } | ||
| command { | ||
| echo "Hello ~{addressee}!" | ||
| } | ||
| output { | ||
| String salutation = read_string(stdout()) | ||
| } | ||
| runtime { | ||
| backend: "LocalDockerSecure" | ||
| docker: "broadinstitute/cromwell-docker-test:private-repo" | ||
| } | ||
| } | ||
|
|
||
| workflow hello_private_repo { | ||
| input { | ||
| String addressee | ||
| } | ||
| call hello { input: addressee = addressee } | ||
| output { | ||
| String salutation = hello.salutation | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| package common.util | ||
|
|
||
| import java.net.URI | ||
| import scala.util.Try | ||
|
|
||
| object UriUtil { | ||
| implicit class EnhancedUri(val uri: URI) extends AnyVal { | ||
|
|
||
| /** | ||
| * Removes userInfo and sensitive query parts from instances of java.net.URI. | ||
| * | ||
| * If the URI query does not contain any detected sensitive information, then the entire query will be masked. | ||
| * | ||
| * Depending on the encoding used in the input URI the masked output may have unexpected encoding. See: | ||
| * - the StringUtilSpec for current expectations | ||
| * - https://stackoverflow.com/questions/4571346/how-to-encode-url-to-avoid-special-characters-in-java#answer-4571518 | ||
| */ | ||
| def maskSensitive: URI = { | ||
| Try { | ||
| new URI( | ||
| uri.getScheme, | ||
| null, // Remove all userInfo | ||
| uri.getHost, | ||
| uri.getPort, | ||
| uri.getPath, | ||
| Option(uri.getQuery).map(maskSensitiveQuery).orNull, | ||
| uri.getFragment, | ||
| ) | ||
| } | ||
| .getOrElse(uri) | ||
| } | ||
| } | ||
|
|
||
| private def maskSensitiveQuery(query: String): String = { | ||
| val parsedQuery: Array[Seq[String]] = | ||
| query | ||
| .split("&") | ||
| .map { param => | ||
| param.split("=", 2).toSeq match { | ||
| case seq @ Seq(_, _) => seq | ||
| case _ => Seq(param) | ||
| } | ||
| } | ||
|
|
||
| if (!parsedQuery.exists(param => isSensitiveKey(param.head))) { | ||
| // Mask the entire query just in case | ||
| "masked" | ||
| } else { | ||
| parsedQuery | ||
| .map { | ||
| case Seq(name, _) if isSensitiveKey(name) => s"$name=masked" | ||
| case seq => seq.mkString("=") | ||
| } | ||
| .mkString("&") | ||
| } | ||
| } | ||
|
|
||
| /* | ||
| Parts of these examples have been redacted even if they will not be masked. | ||
| via: https://bvdp-saturn-dev.appspot.com/#workspaces/general-dev-billing-account/DRS%20and%20Signed%20URL%20Development%20-%20Dev/notebooks/launch/drs_signed_url_flow_kids_dev.ipynb | ||
| ``` | ||
| https://example-redacted-but-not-masked.s3.amazonaws.com/_example_redacted_but_not_masked_.CNVs.p.value.txt | ||
| ?X-Amz-Algorithm=AWS4-HMAC-SHA256 | ||
| &X-Amz-Credential=_to_be_masked_ | ||
| &X-Amz-Date=20210504T200819Z | ||
| &X-Amz-Expires=3600 | ||
| &X-Amz-SignedHeaders=host | ||
| &user_id=122 | ||
| &username=_example_redacted_but_not_masked_ | ||
| &X-Amz-Signature=_to_be_masked_ | ||
| ``` | ||
| via: https://bvdp-saturn-dev.appspot.com/#workspaces/general-dev-billing-account/DRS%20and%20Signed%20URL%20Development%20-%20Dev/notebooks/launch/drs_signed_url_flow_bdcat_dev.ipynb | ||
| ``` | ||
| https://storage.googleapis.com/_example_redacted_but_not_masked_/testfile.txt | ||
| ?GoogleAccessId=_example_redacted_but_not_masked_ | ||
| &Expires=1614119022 | ||
| &Signature=_to_be_masked_ | ||
| &userProject=_example_redacted_but_not_masked_ | ||
| ``` | ||
| */ | ||
| private val SensitiveKeyParts = | ||
| List( | ||
| "credential", | ||
| "signature", | ||
| ) | ||
|
|
||
| private def isSensitiveKey(name: String): Boolean = { | ||
| val lower = name.toLowerCase | ||
| SensitiveKeyParts.exists(lower.contains(_)) | ||
| } | ||
| } |
Oops, something went wrong.