docs(alm): add ui samples#14459
Open
QMeng wants to merge 6 commits into
Open
Conversation
|
Here is the summary of possible violations 😱 DetailsThere is a possible violation for not having product prefix.
The end of the violation section. All the stuff below is FYI purposes only. Here is the summary of changes. You are about to add 1 region tag.
This comment is generated by snippet-bot.
|
product-auto-label
Bot
added
the
samples
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces a Flask-based UI example for Apigee API generation and deployment, along with its Docker configuration and static assets. Feedback highlights a critical command injection vulnerability in app.py due to unsafe shell execution of user-controlled input. Additionally, several files contain redundant or entirely commented-out code—including active_app_backup.py, app2.py, and sections within app.py and the Dockerfile—which should be removed to maintain code cleanliness.
Comment on lines
+39
to
+40
| token_cmd = f"gcloud auth print-access-token --impersonate-service-account={service_account}" | ||
| token = subprocess.check_output(token_cmd, shell=True, text=True).strip() |
Contributor
There was a problem hiding this comment.
Passing user-controlled input (service_account) directly into a shell command string executed via subprocess.check_output(..., shell=True) is highly vulnerable to command injection. An attacker could craft a malicious service account name containing shell metacharacters to execute arbitrary commands on the system.
To mitigate this, pass the command arguments as a list and set shell=False (which is the default).
Suggested change
| token_cmd = f"gcloud auth print-access-token --impersonate-service-account={service_account}" | |
| token = subprocess.check_output(token_cmd, shell=True, text=True).strip() | |
| token_cmd = [ | |
| "gcloud", | |
| "auth", | |
| "print-access-token", | |
| f"--impersonate-service-account={service_account}", | |
| ] | |
| token = subprocess.check_output(token_cmd, text=True).strip() |
Comment on lines
+151
to
+242
| # import os | ||
| # import requests | ||
| # from flask import Flask, render_template, request, make_response, redirect, url_for | ||
|
|
||
| # app = Flask(__name__) | ||
|
|
||
| # GCP_REGIONS = [ | ||
| # "africa-south1", "asia-east1", "asia-east2", "asia-northeast1", "asia-northeast2", | ||
| # "asia-northeast3", "asia-south1", "asia-south2", "asia-southeast1", "asia-southeast2", | ||
| # "australia-southeast1", "australia-southeast2", "europe-central2", "europe-north1", | ||
| # "europe-southwest1", "europe-west1", "europe-west2", "europe-west3", "europe-west4", | ||
| # "europe-west6", "europe-west8", "europe-west9", "europe-west10", "europe-west12", | ||
| # "me-central1", "me-central2", "me-west1", "northamerica-northeast1", "northamerica-northeast2", | ||
| # "southamerica-east1", "southamerica-west1", "us-central1", "us-east1", "us-east4", | ||
| # "us-east5", "us-south1", "us-west1", "us-west2", "us-west3", "us-west4" | ||
| # ] | ||
|
|
||
| # # --- PAGE 1: Generate API & Set Cookie --- | ||
| # @app.route('/', methods=['GET', 'POST']) | ||
| # def generate_api(): | ||
| # generated_value = None | ||
|
|
||
| # if request.method == 'POST': | ||
| # # 1. Get the values from the two input boxes | ||
| # input_1 = request.form.get('input1') | ||
| # input_2 = request.form.get('input2') | ||
|
|
||
| # # 2. Simulate "generating" a value based on the inputs | ||
| # generated_value = f"api_key_{input_1}_{input_2}_8384" | ||
|
|
||
| # # 3. Create the response object so we can attach a cookie to it | ||
| # resp = make_response(render_template('page1.html', generated_value=generated_value)) | ||
|
|
||
| # # 4. Set the cookie (named 'generated_api_value') | ||
| # resp.set_cookie('generated_api_value', generated_value) | ||
| # return resp | ||
|
|
||
| # # Check if cookie already exists on GET request | ||
| # existing_cookie = request.cookies.get('generated_api_value') | ||
|
|
||
| # return render_template('page1.html', generated_value=existing_cookie) | ||
|
|
||
|
|
||
| # # --- PAGE 2: GCP Region Selector (Your existing logic) --- | ||
| # @app.route('/deploy', methods=['GET', 'POST']) | ||
| # def deploy_page(): | ||
| # # You can access the cookie here if you need it for your API calls! | ||
| # # saved_api_value = request.cookies.get('generated_api_value') | ||
|
|
||
| # selected_region = None | ||
| # api_response_data = None | ||
| # operation_state = None | ||
|
|
||
| # if request.method == 'POST': | ||
| # selected_region = request.form.get('region') | ||
| # action = request.form.get('action') | ||
|
|
||
| # if action == 'deploy': | ||
| # url = "https://apigee.saas8384.saas-example.com/v1/saas/operations" | ||
| # headers = {"Content-Type": "application/json"} | ||
| # payload = {"region": selected_region} | ||
|
|
||
| # try: | ||
| # response = requests.post(url, headers=headers, json=payload) | ||
| # response.raise_for_status() | ||
| # api_response_data = response.json() | ||
| # except requests.exceptions.RequestException as e: | ||
| # api_response_data = {"error": str(e)} | ||
|
|
||
| # elif action == 'status': | ||
| # operation_id = "depr-25094d41-7768-4ef3-bd8d-e5bf67ca09d6" | ||
| # url = f"https://apigee.saas8384.saas-example.com/v1/saas/operations/{operation_id}?region={selected_region}" | ||
|
|
||
| # try: | ||
| # response = requests.get(url) | ||
| # response.raise_for_status() | ||
| # operation_state = response.json().get('state', 'STATE_UNKNOWN') | ||
| # except requests.exceptions.RequestException as e: | ||
| # operation_state = "ERROR_FETCHING_STATE" | ||
|
|
||
| # return render_template( | ||
| # 'page2.html', | ||
| # regions=GCP_REGIONS, | ||
| # selected_region=selected_region, | ||
| # api_response=api_response_data, | ||
| # operation_state=operation_state | ||
| # ) | ||
|
|
||
| # if __name__ == '__main__': | ||
| # port = int(os.environ.get("PORT", 8080)) | ||
| # app.run(host='0.0.0.0', port=port, debug=True) | ||
|
|
Contributor
There was a problem hiding this comment.
This file contains a large block of commented-out code at the end. Please remove this dead code to keep the codebase clean and maintainable.
Comment on lines
+36
to
+70
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
| # # Use a slim version to keep the image small | ||
| # FROM python:3.12-slim | ||
|
|
||
| # # Set working directory | ||
| # WORKDIR /app | ||
|
|
||
| # # Prevent Python from writing .pyc files and enable unbuffered logging | ||
| # ENV PYTHONDONTWRITEBYTECODE=1 | ||
| # ENV PYTHONUNBUFFERED=1 | ||
|
|
||
| # # Install system dependencies (only what's necessary for your app) | ||
| # # If you don't need 'curl', 'jq', or 'gcloud' inside the running app, remove them! | ||
| # RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| # build-essential \ | ||
| # && apt-get clean \ | ||
| # && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # # Install Python packages | ||
| # COPY requirements.txt . | ||
| # RUN pip install --no-cache-dir -r requirements.txt | ||
|
|
||
| # # Copy app code into container | ||
| # COPY . . | ||
|
|
||
| # # Cloud Run sets the $PORT environment variable automatically | ||
| # # We use exec form for the CMD to handle signals properly | ||
| # CMD exec gunicorn --bind :$PORT --workers 1 --threads 8 --timeout 0 app:app No newline at end of file |
Contributor
There was a problem hiding this comment.
Please remove the commented-out duplicate Dockerfile instructions at the end of the file to keep it clean and maintainable.
Comment on lines
+1
to
+124
|
|
||
| import os | ||
| import requests | ||
| from flask import Flask, render_template, request | ||
|
|
||
| app = Flask(__name__) | ||
|
|
||
| # A comprehensive list of GCP regions | ||
| GCP_REGIONS = [ | ||
| "africa-south1", | ||
| "asia-east1", "asia-east2", "asia-northeast1", "asia-northeast2", "asia-northeast3", | ||
| "asia-south1", "asia-south2", "asia-southeast1", "asia-southeast2", | ||
| "australia-southeast1", "australia-southeast2", | ||
| "europe-central2", "europe-north1", "europe-southwest1", | ||
| "europe-west1", "europe-west2", "europe-west3", "europe-west4", | ||
| "europe-west6", "europe-west8", "europe-west9", "europe-west10", "europe-west12", | ||
| "me-central1", "me-central2", "me-west1", | ||
| "northamerica-northeast1", "northamerica-northeast2", | ||
| "southamerica-east1", "southamerica-west1", | ||
| "us-central1", "us-east1", "us-east4", "us-east5", | ||
| "us-south1", "us-west1", "us-west2", "us-west3", "us-west4" | ||
| ] | ||
|
|
||
| @app.route('/', methods=['GET', 'POST']) | ||
| def index(): | ||
| selected_region = None | ||
| api_response_data = None | ||
| operation_state = None | ||
|
|
||
| if request.method == 'POST': | ||
| # Get the selected region and which button was clicked | ||
| selected_region = request.form.get('region') | ||
| action = request.form.get('action') | ||
|
|
||
| # --- DEPLOY BUTTON CLICKED --- | ||
| if action == 'deploy': | ||
| print(f"\n--- SUCCESS: User clicked DEPLOY for: {selected_region} ---\n") | ||
| url = "https://apigee.saas8384.saas-example.com/v1/saas/operations" | ||
| headers = {"Content-Type": "application/json"} | ||
| payload = {"region": selected_region} | ||
|
|
||
| try: | ||
| response = requests.post(url, headers=headers, json=payload) | ||
| response.raise_for_status() | ||
| api_response_data = response.json() | ||
| print(f"Deploy Successful. Response: {api_response_data}") | ||
| except requests.exceptions.RequestException as e: | ||
| print(f"API Call Failed: {e}") | ||
| api_response_data = {"error": str(e)} | ||
|
|
||
| # --- GET STATUS BUTTON CLICKED --- | ||
| elif action == 'status': | ||
| print(f"\n--- SUCCESS: User clicked STATUS for: {selected_region} ---\n") | ||
| operation_id = "depr-25094d41-7768-4ef3-bd8d-e5bf67ca09d6" | ||
| url = f"https://apigee.saas8384.saas-example.com/v1/saas/operations/{operation_id}?region={selected_region}" | ||
|
|
||
| try: | ||
| response = requests.get(url) | ||
| response.raise_for_status() | ||
|
|
||
| # Parse JSON and get the state | ||
| get_data = response.json() | ||
| operation_state = get_data.get('state', 'STATE_UNKNOWN') | ||
| print(f"Status check successful. State: {operation_state}") | ||
|
|
||
| except requests.exceptions.RequestException as e: | ||
| print(f"Status API Call Failed: {e}") | ||
| operation_state = "ERROR_FETCHING_STATE" | ||
|
|
||
| return render_template( | ||
| 'index.html', | ||
| regions=GCP_REGIONS, | ||
| selected_region=selected_region, | ||
| api_response=api_response_data, | ||
| operation_state=operation_state | ||
| ) | ||
|
|
||
| if __name__ == '__main__': | ||
| port = int(os.environ.get("PORT", 8080)) | ||
| app.run(host='0.0.0.0', port=port, debug=False) | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
| # from flask import Flask, render_template, request | ||
|
|
||
| # app = Flask(__name__) | ||
|
|
||
| # # A comprehensive list of GCP regions | ||
| # GCP_REGIONS = [ | ||
| # "africa-south1", | ||
| # "asia-east1", "asia-east2", "asia-northeast1", "asia-northeast2", "asia-northeast3", | ||
| # "asia-south1", "asia-south2", "asia-southeast1", "asia-southeast2", | ||
| # "australia-southeast1", "australia-southeast2", | ||
| # "europe-central2", "europe-north1", "europe-southwest1", | ||
| # "europe-west1", "europe-west2", "europe-west3", "europe-west4", | ||
| # "europe-west6", "europe-west8", "europe-west9", "europe-west10", "europe-west12", | ||
| # "me-central1", "me-central2", "me-west1", | ||
| # "northamerica-northeast1", "northamerica-northeast2", | ||
| # "southamerica-east1", "southamerica-west1", | ||
| # "us-central1", "us-east1", "us-east4", "us-east5", | ||
| # "us-south1", "us-west1", "us-west2", "us-west3", "us-west4" | ||
| # ] | ||
|
|
||
| # @app.route('/', methods=['GET', 'POST']) | ||
| # def index(): | ||
| # selected_region = None | ||
|
|
||
| # if request.method == 'POST': | ||
| # # Get the selected region from the HTML form | ||
| # selected_region = request.form.get('region') | ||
|
|
||
| # # Print the selected value to the console/terminal | ||
| # print(f"\n--- SUCCESS: User selected GCP Region: {selected_region} ---\n") | ||
|
|
||
| # return render_template('index.html', regions=GCP_REGIONS, selected_region=selected_region) | ||
|
|
||
| # if __name__ == '__main__': | ||
| # port = int(os.environ.get("PORT", 8080)) | ||
| # app.run(host='0.0.0.0', port=port, debug=False) No newline at end of file |
Contributor
There was a problem hiding this comment.
This backup file (active_app_backup.py) appears to be redundant and contains a large amount of commented-out code. Please remove this file from the repository.
Comment on lines
+1
to
+166
| # import os | ||
| # import requests | ||
| # from flask import Flask, render_template, request | ||
|
|
||
| # app = Flask(__name__) | ||
|
|
||
| # # A comprehensive list of GCP regions | ||
| # GCP_REGIONS = [ | ||
| # "africa-south1", | ||
| # "asia-east1", "asia-east2", "asia-northeast1", "asia-northeast2", "asia-northeast3", | ||
| # "asia-south1", "asia-south2", "asia-southeast1", "asia-southeast2", | ||
| # "australia-southeast1", "australia-southeast2", | ||
| # "europe-central2", "europe-north1", "europe-southwest1", | ||
| # "europe-west1", "europe-west2", "europe-west3", "europe-west4", | ||
| # "europe-west6", "europe-west8", "europe-west9", "europe-west10", "europe-west12", | ||
| # "me-central1", "me-central2", "me-west1", | ||
| # "northamerica-northeast1", "northamerica-northeast2", | ||
| # "southamerica-east1", "southamerica-west1", | ||
| # "us-central1", "us-east1", "us-east4", "us-east5", | ||
| # "us-south1", "us-west1", "us-west2", "us-west3", "us-west4" | ||
| # ] | ||
|
|
||
| # @app.route('/', methods=['GET', 'POST']) | ||
| # def index(): | ||
| # selected_region = None | ||
| # api_response_data = None | ||
| # operation_state = None | ||
|
|
||
| # if request.method == 'POST': | ||
| # # Get the selected region and which button was clicked | ||
| # selected_region = request.form.get('region') | ||
| # action = request.form.get('action') | ||
|
|
||
| # # --- DEPLOY BUTTON CLICKED --- | ||
| # if action == 'deploy': | ||
| # print(f"\n--- SUCCESS: User clicked DEPLOY for: {selected_region} ---\n") | ||
| # url = "https://apigee.saas8384.saas-example.com/v1/saas/operations" | ||
| # headers = {"Content-Type": "application/json"} | ||
| # payload = {"region": selected_region} | ||
|
|
||
| # try: | ||
| # response = requests.post(url, headers=headers, json=payload) | ||
| # response.raise_for_status() | ||
| # api_response_data = response.json() | ||
| # print(f"Deploy Successful. Response: {api_response_data}") | ||
| # except requests.exceptions.RequestException as e: | ||
| # print(f"API Call Failed: {e}") | ||
| # api_response_data = {"error": str(e)} | ||
|
|
||
| # # --- GET STATUS BUTTON CLICKED --- | ||
| # elif action == 'status': | ||
| # print(f"\n--- SUCCESS: User clicked STATUS for: {selected_region} ---\n") | ||
| # operation_id = "depr-25094d41-7768-4ef3-bd8d-e5bf67ca09d6" | ||
| # url = f"https://apigee.saas8384.saas-example.com/v1/saas/operations/{operation_id}?region={selected_region}" | ||
|
|
||
| # try: | ||
| # response = requests.get(url) | ||
| # response.raise_for_status() | ||
|
|
||
| # # Parse JSON and get the state | ||
| # get_data = response.json() | ||
| # operation_state = get_data.get('state', 'STATE_UNKNOWN') | ||
| # print(f"Status check successful. State: {operation_state}") | ||
|
|
||
| # except requests.exceptions.RequestException as e: | ||
| # print(f"Status API Call Failed: {e}") | ||
| # operation_state = "ERROR_FETCHING_STATE" | ||
|
|
||
| # return render_template( | ||
| # 'index.html', | ||
| # regions=GCP_REGIONS, | ||
| # selected_region=selected_region, | ||
| # api_response=api_response_data, | ||
| # operation_state=operation_state | ||
| # ) | ||
|
|
||
| # if __name__ == '__main__': | ||
| # port = int(os.environ.get("PORT", 8080)) | ||
| # app.run(host='0.0.0.0', port=port, debug=False) | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
| # import os | ||
| # import requests | ||
| # from flask import Flask, render_template, request | ||
|
|
||
| # app = Flask(__name__) | ||
|
|
||
| # # A comprehensive list of GCP regions | ||
| # GCP_REGIONS = [ | ||
| # "africa-south1", | ||
| # "asia-east1", "asia-east2", "asia-northeast1", "asia-northeast2", "asia-northeast3", | ||
| # "asia-south1", "asia-south2", "asia-southeast1", "asia-southeast2", | ||
| # "australia-southeast1", "australia-southeast2", | ||
| # "europe-central2", "europe-north1", "europe-southwest1", | ||
| # "europe-west1", "europe-west2", "europe-west3", "europe-west4", | ||
| # "europe-west6", "europe-west8", "europe-west9", "europe-west10", "europe-west12", | ||
| # "me-central1", "me-central2", "me-west1", | ||
| # "northamerica-northeast1", "northamerica-northeast2", | ||
| # "southamerica-east1", "southamerica-west1", | ||
| # "us-central1", "us-east1", "us-east4", "us-east5", | ||
| # "us-south1", "us-west1", "us-west2", "us-west3", "us-west4" | ||
| # ] | ||
|
|
||
| # @app.route('/', methods=['GET', 'POST']) | ||
| # def index(): | ||
| # selected_region = None | ||
| # api_response_data = None | ||
|
|
||
| # if request.method == 'POST': | ||
| # # Get the selected region from the HTML form | ||
| # selected_region = request.form.get('region') | ||
|
|
||
| # # Print the selected value to the console/terminal | ||
| # print(f"\n--- SUCCESS: User selected GCP Region: {selected_region} ---\n") | ||
|
|
||
| # # --- NEW API CALL LOGIC --- | ||
| # url = "https://apigee.saas8384.saas-example.com/v1/saas/operations" | ||
|
|
||
| # headers = { | ||
| # "Content-Type": "application/json" | ||
| # } | ||
| # # Construct the payload dynamically using the selected_region | ||
| # payload = { | ||
| # "region": selected_region | ||
| # } | ||
|
|
||
| # try: | ||
| # # Using the requests library to send the POST request | ||
| # # requests.post's `json=` parameter automatically handles JSON serialization | ||
| # response = requests.post(url, headers=headers, json=payload) | ||
|
|
||
| # # Raise an exception if the HTTP request returned an unsuccessful status code | ||
| # response.raise_for_status() | ||
|
|
||
| # print(f"API Call Successful. Status Code: {response.status_code}") | ||
|
|
||
| # # Store the response to optionally pass it to the template | ||
| # api_response_data = response.json() | ||
| # print(f"Response Body: {api_response_data}") | ||
|
|
||
| # except requests.exceptions.RequestException as e: | ||
| # # Handle potential errors (e.g., connection refused, timeout, 4xx/5xx errors) | ||
| # print(f"API Call Failed: {e}") | ||
| # api_response_data = {"error": str(e)} | ||
|
|
||
| # # I've added api_response_data here in case you want to display the API's response on index.html | ||
| # return render_template('index.html', regions=GCP_REGIONS, selected_region=selected_region, api_response=api_response_data) | ||
|
|
||
| # if __name__ == '__main__': | ||
| # port = int(os.environ.get("PORT", 8080)) | ||
| # app.run(host='0.0.0.0', port=port, debug=False) |
Contributor
There was a problem hiding this comment.
This file is entirely commented out. Please remove this file from the repository to avoid cluttering the codebase.
Author
|
ALM isn't in Snippet-Bot's official product list yet, but |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #
Checklist
Testing
Compliance & Style
Post-Approval Actions