From a8c04fcd797cbed9dbc65660daddfda06a304160 Mon Sep 17 00:00:00 2001 From: GOKULRAJ136 <110164849+GOKULRAJ136@users.noreply.github.com> Date: Wed, 10 Jun 2026 11:47:12 +0530 Subject: [PATCH 1/3] Security vulnerabilities and runtime bugs fix upgrade scripts Signed-off-by: GOKULRAJ136 <110164849+GOKULRAJ136@users.noreply.github.com> --- .../1.1.5.5_to_1.2.0.1/data-uploader.py | 12 +++++++----- .../1.1.5.5_to_1.2.0.1/migration-ui_spec.py | 6 +++--- .../data_upgrade/1.1.5.5_to_1.2.0.1/upgrade.sh | 8 ++++++-- .../1.2.0.1_to_1.3.0/data-uploader.py | 15 ++++++++------- .../data_upgrade/1.2.0.1_to_1.3.0/upgrade.sh | 8 ++++++-- 5 files changed, 30 insertions(+), 19 deletions(-) diff --git a/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/data-uploader.py b/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/data-uploader.py index 8f2ec576..6b3074fb 100644 --- a/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/data-uploader.py +++ b/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/data-uploader.py @@ -12,6 +12,7 @@ import sys import time import psycopg2 +from psycopg2 import sql import openpyxl parser = argparse.ArgumentParser(description='This is CSV/xlsx file uploader script.invokes 1.2.0.1 bulk upload endpoints') @@ -47,17 +48,18 @@ def getCurrentDateTime(): def get_seed_value(): conn = psycopg2.connect(database="mosip_master", user = args.dbusername, password = args.dbpassword, host = args.dbhost, port = args.dbport) cursor = conn.cursor() - cursor.execute("select id from master."+args.table+" order by id desc limit 20") + cursor.execute(sql.SQL("select id from master.{} order by id desc limit 20").format(sql.Identifier(args.table))) + seed_value = None for row in cursor.fetchall(): id_value = row[0] if id_value is None: seed_value = 1000 break - if id_value.isdigit(): + if str(id_value).isdigit(): seed_value = id_value - break; - - if seed_value == None: + break + + if seed_value is None: seed_value = 1000 return seed_value diff --git a/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/migration-ui_spec.py b/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/migration-ui_spec.py index 45697832..ead4b3a3 100644 --- a/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/migration-ui_spec.py +++ b/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/migration-ui_spec.py @@ -49,9 +49,9 @@ def getSupportedAgeGroups(): agegroup_config_json=json.loads(agegroup_config) for ageGroup in agegroup_config_json.keys(): - modalities = [] - while not modalities: - modalities = agegroup_config_json.get(ageGroup).get("bioAttributes") + modalities = agegroup_config_json.get(ageGroup).get("bioAttributes") + if modalities is None: + modalities = [] ageGroupBasedModalities[ageGroup] = modalities requiresGuardianAuth = agegroup_config_json.get(ageGroup).get("isGuardianAuthRequired") diff --git a/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/upgrade.sh b/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/upgrade.sh index 2277ea46..b1d8306f 100755 --- a/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/upgrade.sh +++ b/mosip_master/data_upgrade/1.1.5.5_to_1.2.0.1/upgrade.sh @@ -8,8 +8,12 @@ then echo `date "+%m/%d/%Y %H:%M:%S"` ": Property file \"$properties_file\" found." while IFS='=' read -r key value do - key=$(echo $key | tr '.' '_') - eval ${key}=\${value} + key=$(echo "$key" | tr '.' '_') + if [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then + printf -v "$key" '%s' "$value" + else + echo "WARNING: Skipping invalid property key: $key" + fi done < "$properties_file" else echo `date "+%m/%d/%Y %H:%M:%S"` ": Property file not found, Pass property file name as argument." diff --git a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py index 8f2ec576..f3f6d052 100644 --- a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py +++ b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py @@ -45,6 +45,7 @@ def getCurrentDateTime(): def get_seed_value(): + seed_value = None conn = psycopg2.connect(database="mosip_master", user = args.dbusername, password = args.dbpassword, host = args.dbhost, port = args.dbport) cursor = conn.cursor() cursor.execute("select id from master."+args.table+" order by id desc limit 20") @@ -53,11 +54,11 @@ def get_seed_value(): if id_value is None: seed_value = 1000 break - if id_value.isdigit(): + if str(id_value).isdigit(): seed_value = id_value - break; - - if seed_value == None: + break + + if seed_value is None: seed_value = 1000 return seed_value @@ -95,12 +96,12 @@ def fill_series(): print("Start Row: ", start_row) print("End Row: ", end_row) - if(start_row is None and end_row is None): - print("Need a valid start_row and end_row!") + if end_row is None: + print("Need a valid end_row!") return for i, value in enumerate(range(start_row, end_row + 1), start=1): - column[i].value = int(seed_value) + value + column[i].value = int(seed_value) + i workbook.save(args.file) workbook.close() diff --git a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/upgrade.sh b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/upgrade.sh index 2277ea46..b1d8306f 100755 --- a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/upgrade.sh +++ b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/upgrade.sh @@ -8,8 +8,12 @@ then echo `date "+%m/%d/%Y %H:%M:%S"` ": Property file \"$properties_file\" found." while IFS='=' read -r key value do - key=$(echo $key | tr '.' '_') - eval ${key}=\${value} + key=$(echo "$key" | tr '.' '_') + if [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then + printf -v "$key" '%s' "$value" + else + echo "WARNING: Skipping invalid property key: $key" + fi done < "$properties_file" else echo `date "+%m/%d/%Y %H:%M:%S"` ": Property file not found, Pass property file name as argument." From fb1616f4a1e5dc8c08ff51e3989821961b12bf75 Mon Sep 17 00:00:00 2001 From: GOKULRAJ136 <110164849+GOKULRAJ136@users.noreply.github.com> Date: Wed, 10 Jun 2026 12:07:46 +0530 Subject: [PATCH 2/3] Update data-uploader.py Signed-off-by: GOKULRAJ136 <110164849+GOKULRAJ136@users.noreply.github.com> --- mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py index f3f6d052..87496845 100644 --- a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py +++ b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py @@ -12,6 +12,7 @@ import sys import time import psycopg2 +from psycopg2 import sql import openpyxl parser = argparse.ArgumentParser(description='This is CSV/xlsx file uploader script.invokes 1.2.0.1 bulk upload endpoints') @@ -48,7 +49,10 @@ def get_seed_value(): seed_value = None conn = psycopg2.connect(database="mosip_master", user = args.dbusername, password = args.dbpassword, host = args.dbhost, port = args.dbport) cursor = conn.cursor() - cursor.execute("select id from master."+args.table+" order by id desc limit 20") + cursor.execute( + sql.SQL("select id from master.{} order by id desc limit 20") + .format(sql.Identifier(args.table)) + ) for row in cursor.fetchall(): id_value = row[0] if id_value is None: From 4cb958d0c8ce42bd863093dce24391c8e3055147 Mon Sep 17 00:00:00 2001 From: GOKULRAJ136 <110164849+GOKULRAJ136@users.noreply.github.com> Date: Thu, 11 Jun 2026 10:43:00 +0530 Subject: [PATCH 3/3] Update data-uploader.py Signed-off-by: GOKULRAJ136 <110164849+GOKULRAJ136@users.noreply.github.com> --- mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py index 87496845..cc0ccd54 100644 --- a/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py +++ b/mosip_master/data_upgrade/1.2.0.1_to_1.3.0/data-uploader.py @@ -105,7 +105,7 @@ def fill_series(): return for i, value in enumerate(range(start_row, end_row + 1), start=1): - column[i].value = int(seed_value) + i + column[i].value = int(seed_value) + value workbook.save(args.file) workbook.close()