Release v2.67.0#10705
Merged
Merged
Conversation
Update develop after v2.66.0
Fix UserWarning
Bumps [js-cookie](https://github.com/js-cookie/js-cookie) from 3.0.5 to 3.0.7. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Kirill Lakhov <kirill.lakhov@cvat.ai>
- Upgraded drf-spectacular from 0.26.2 to 0.29.0. - Fixed /api/schema RSS growth: local and canary testing showed the old version caused near-linear RSS growth, while 0.29.0 reaches a small plateau. - Added explicit schema annotations for RequestViewSet path parameter id. ```console /home/django/cvat/apps/redis_handler/views.py: Warning [RequestViewSet]: could not derive type of path parameter "id" because it is untyped and obtaining queryset from the viewset failed. Consider adding a type to the path (e.g. <int:id>) or annotating the parameter type with @extend_schema. Defaulting to "string". ``` - Avoided schema-generation warnings for non-model RequestViewSet. ```console /home/django/cvat/apps/redis_handler/views.py: Warning [RequestViewSet]: Failed to obtain model through view's queryset due to raised exception. Prevent this either by setting "queryset = Model.objects.none()" on the view, checking for "getattr(self, "swagger_fake_view", False)" in get_queryset() or by simply using @extend_schema. (Exception: 'NoneType' object has no attribute 'model') ``` - Fixed events cache cleanup so clear_cache() removes the per-request cache entry instead of only clearing its contents. tested /api/schema/?lang=en&scheme=json with 250 requests. Before upgrade: RSS grew from ~315 MB to ~930 MB. After upgrade: RSS stabilized around ~345 MB. ### Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. If an item isn't applicable for some reason, then ~~explicitly strikethrough~~ the whole line. If you don't do that, GitHub will show incorrect progress for the pull request. If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] I submit my changes into the `develop` branch - [x] I have created a changelog fragment <!-- see top comment in CHANGELOG.md --> - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [x] I have linked related issues (see [GitHub docs]( https://help.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)) ### License - [x] I submit _my code changes_ under the same [MIT License]( https://github.com/cvat-ai/cvat/blob/develop/LICENSE) that covers the project. Feel free to contact the maintainers if that's a concern.
All users are added to the "user" group by default. So when `self.assignee` and `self.annotator` are added to the "worker" group, they become both users _and_ workers, which effectively gives them user privileges. I'm fairly sure those users are only meant to have worker privileges. Fix this by replacing `groups.add` with `groups.set`. Also, remove redundant additions of the `user` and `admin` groups. This makes a few tests fail, but I think the tests are wrong here, so fix them. Workers have no need to access the mounted share contents, because they can't create tasks.
Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.15.2. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Kirill Lakhov <kirill.lakhov@cvat.ai>
Updated: - nltk to 3.9.4 - pyarrow to 24.0.0 - urllib3 to 2.7.0 Golang build image to 1.26.3 ### License - [x] I submit _my code changes_ under the same [MIT License]( https://github.com/cvat-ai/cvat/blob/develop/LICENSE) that covers the project. Feel free to contact the maintainers if that's a concern.
When an asset is uploaded, we check the `Content-Type` supplied by the user, but when we serve an asset, we do it with a `Content-Type` autodetected from the filename. So it's trivial for an attacker to upload `evil.html` with a `Content-Type` of `image/gif`, which CVAT will then serve with a `Content-Type` of `text/html`. If a user is tricked into opening a link to this asset, the HTML file can execute arbitrary code with that user's privileges. Fix it by verifying that the supplied `Content-Type` is the same as the autodetected one. As a backup, also add a restrictive CSP when serving assets (this should also neutralize any malicious assets created before this patch is deployed).
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added
previewendpoints accept thePrefer: handling=emptyheader (RFC 7240). When set, entities without a media-derived preview (e.g. point cloud tasks) return204 No Contentinstead of the default placeholder. (Add server opt-in for client-side preview placeholders #10611)Fixed
[SDK] Fixed a PyTorch
UserWarningabout non-writable tensors when converting polygon masks to tensors inExtractInstanceMasks. (Fix UserWarning #10680)Memory growth during schema generation (Fix memory growth during schema generation #10679)
Security