chore: Migrate gsutil usage to gcloud storage#184
Conversation
|
Hi @functicons, Can we get your review on this PR? Thanks! |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request systematically updates various scripts and documentation to transition from the legacy Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request automates the migration of gsutil commands to the more modern gcloud storage CLI across Python scripts, shell scripts, and documentation files (.md). While the automated replacements for commands like cp, ls, rm, mb, and iam ch appear correct and preserve the scripts' logic, a critical security concern has been identified. The audit revealed multiple instances of potential command injection vulnerabilities, arising from constructing shell commands using unvalidated external input (from command-line arguments or configuration files) and executing them via shell=True in Python or eval and unquoted variables in Bash. It is crucial to address these by sanitizing all external inputs and using safer methods for command execution, such as passing arguments as lists in Python and properly quoting all variables in Bash.
| command = "gcloud storage cp {} {} ".format(scenario.config_file_name, | ||
| scenario_destination_bucket_path) |
There was a problem hiding this comment.
The command string is constructed using .format() with variables scenario.config_file_name and scenario_destination_bucket_path, which are derived from YAML configuration files. Since this command is executed via execute_shell (which uses subprocess.Popen(cmd, shell=True)), it is vulnerable to command injection if the YAML content or scenario names contain shell metacharacters. It is recommended to avoid shell=True and pass arguments as a list.
| command = "gcloud storage cp /Big-Data-Benchmark-for-Big-Bench/logs/{} {}{}" \ | ||
| .format(file, output_path, file) |
There was a problem hiding this comment.
The command string is constructed using .format() with file and output_path. output_path is derived from sys.argv[1] and sys.argv[2], which are untrusted command-line arguments. Since the command is executed via execute_shell (which uses subprocess.Popen(cmd, shell=True)), an attacker can inject arbitrary shell commands by providing malicious command-line arguments. It is recommended to avoid shell=True and pass arguments as a list.
| .read() | ||
| output_path = "{}/{}/{}/hibench.report".format(sys.argv[1], sys.argv[2], cluster_name) | ||
| cmd = "gsutil cp /HiBench/report/hibench.report {}".format(output_path) | ||
| cmd = "gcloud storage cp /HiBench/report/hibench.report {}".format(output_path) |
There was a problem hiding this comment.
The command string is constructed using .format() with output_path, which is derived from sys.argv[1] and sys.argv[2]. Since the command is executed via execute_shell (which uses subprocess.Popen(cmd, shell=True)), an attacker can inject arbitrary shell commands by providing malicious command-line arguments. It is recommended to avoid shell=True and pass arguments as a list.
| check_exists "GCS Staging Bucket gs://${BUCKET}" "gcloud storage ls --buckets 'gs://${BUCKET}'" | ||
| check_exists "GCS Temp Bucket gs://${TEMP_BUCKET}" "gcloud storage ls --buckets 'gs://${TEMP_BUCKET}'" |
There was a problem hiding this comment.
The script calls check_exists with a command string that includes ${BUCKET} and ${TEMP_BUCKET}. These variables are sourced from env.json and are not sanitized. The check_exists function (defined in lib/script-utils.sh) uses eval to execute the command string. An attacker who can control the values in env.json can inject arbitrary shell commands by escaping the single quotes in the command string. It is recommended to avoid using eval and to ensure variables are properly quoted and validated.
| check_resource_exact "GCS Staging Bucket gs://${BUCKET}" "gcloud storage ls --buckets 'gs://${BUCKET}'" true | ||
| check_resource_exact "GCS Temp Bucket gs://${TEMP_BUCKET}" "gcloud storage ls --buckets 'gs://${TEMP_BUCKET}'" true |
There was a problem hiding this comment.
The script calls check_resource_exact with command strings containing ${BUCKET} and ${TEMP_BUCKET}. check_resource_exact uses eval (defined in lib/script-utils.sh), leading to potential command injection if the variables in env.json contain shell metacharacters. It is recommended to avoid using eval and to ensure variables are properly quoted and validated.
| check_exists "GCS Staging Bucket gs://${BUCKET}" "gcloud storage ls --buckets 'gs://${BUCKET}'" | ||
| check_exists "GCS Temp Bucket gs://${TEMP_BUCKET}" "gcloud storage ls --buckets 'gs://${TEMP_BUCKET}'" |
There was a problem hiding this comment.
The script calls check_exists with command strings containing ${BUCKET} and ${TEMP_BUCKET}. check_exists uses eval (defined in lib/script-utils.sh), leading to potential command injection if the variables in env.json contain shell metacharacters. It is recommended to avoid using eval and to ensure variables are properly quoted and validated.
| check_resource_exact "GCS Staging Bucket gs://${BUCKET}" "gcloud storage ls --buckets 'gs://${BUCKET}'" true | ||
| check_resource_exact "GCS Temp Bucket gs://${TEMP_BUCKET}" "gcloud storage ls --buckets 'gs://${TEMP_BUCKET}'" true |
There was a problem hiding this comment.
The script calls check_resource_exact with command strings containing ${BUCKET} and ${TEMP_BUCKET}. check_resource_exact uses eval (defined in lib/script-utils.sh), leading to potential command injection if the variables in env.json contain shell metacharacters. It is recommended to avoid using eval and to ensure variables are properly quoted and validated.
|
|
||
| # Copy latest initialization action scripts | ||
| gsutil -m cp -r init/* gs://${BUCKET}/dataproc-initialization-actions | ||
| gcloud storage cp --recursive init/* gs://${BUCKET}/dataproc-initialization-actions |
There was a problem hiding this comment.
The variable ${BUCKET} is unquoted in the command execution. If ${BUCKET} contains shell metacharacters (e.g., ;), it can lead to command injection. It is recommended to always quote variables in shell scripts, e.g., gs://"${BUCKET}"/.
1 participant
Automated: Migrate {target_path} from gsutil to gcloud storage
This CL is part of the on going effort to migrate from the legacy
gsutiltool to the new and improvedgcloud storagecommand-line interface.gcloud storageis the recommended and modern tool for interacting with Google Cloud Storage, offering better performance, unified authentication, and a more consistent command structure with othergcloudcomponents. 🚀Automation Details
This change was generated automatically by an agent that targets users of
gsutil.The transformations applied are based on the gsutil to gcloud storage migration guide.
While we have based the automation on the migration guide, every use case is unique.
It is crucial that you thoroughly test these changes in environments appropriate to your use-case before merging.
Be aware of potential differences between
gsutilandgcloud storagethat could impact your workflows.For instance, the structure of command output may have changed, requiring updates to any scripts that parse it. Similarly, command behavior can differ subtly; the
gcloud storage rsynccommand has a different file deletion logic thangsutil rsync, which could lead to unintended file deletions.Our migration guides can help guide you through a list of mappings and some notable differences between the two tools.
Standard presubmit tests are run as part of this CL's workflow. If you need to target an additional test workflow or require assistance with testing, please let us know.
Please verify that all your Cloud Storage operations continue to work as expected to avoid any potential disruptions in production.
Support and Collaboration
The
GCS CLIteam is here to help! If you encounter any issues, have a complex use case that this automated change doesn't cover, or face any other blockers, please don't hesitate to reach out.We are happy to work with you to test and adjust these changes as needed.
Contact:
gcs-cli-hyd@google.comWe appreciate your partnership in this important migration effort!
#gsutil-migration