sequenceserver 3.1.3 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc2b537e7c30e2f882bbf34228d607b5cd51ee3b2b23de202bc472e6977638e6
-  data.tar.gz: 1d0a3c11b9d468fb5ad30df26fd58637f866afcbf3a00f7586244f4c65dca146
+  metadata.gz: f52305fc6b02d855f14730d480c99e940cf384c78b43f8791b789d4fd92b10bf
+  data.tar.gz: 2b8467a02de662d8a8e74f15916973000da735440a5651705fa3cce0df1c4b15
 SHA512:
-  metadata.gz: 98113d4caa432621cc0e5e0749649f11cebc2db613f8e1ecffe3149570b5a35050e8095961ab80cf231eab7b3ca9845f291eefcd7c0f314b4fc3f04e5e2d0b0d
-  data.tar.gz: 8260f22915cbfe511f9bd2a8b11a6f900478bde088162bc38aba49f22150936419f0b3e889f475ed391621e3804a7e7cffcd79dba4ef0988e7cc486a0a37c28c
+  metadata.gz: 53226eb96fce945402ea6889b188aff8431c15672b8fd57686143aaca48bacda86acfaa3c15e7843c91cdc9113545b0d042910ccbd36d32cb9d478e5b1b67da9
+  data.tar.gz: a2df8167ce52ce9461c0079f000b41f0508dcb36a1ab751a46012737dd9b9a34e953a327093457d1f72dcdc51079b478235cfc641b1fcbdd3085699c72a2f5ce

data/lib/sequenceserver/api_errors.rb

@@ -128,6 +128,24 @@ module SequenceServer
     attr_reader :more_info
   end
 
+  class XmlImportError < APIError
+    def http_status
+      400
+    end
+
+    def title
+      'XML import failed'
+    end
+
+    def message
+      'Please make sure the XML file is a valid BLAST output.'
+    end
+
+    def more_info
+      'Make sure the XML you are importing is generated by blast with -outfmt 5 option.'
+    end
+  end
+
   # Errors caused by everything other than invalid user input.
   class SystemError < APIError
     def initialize(more_info = nil)

data/lib/sequenceserver/blast/hit.rb

@@ -38,8 +38,7 @@ module SequenceServer
       # instance methods of the Links module.
       def links
         links = Links.instance_methods.map { |m| send m }
-        links.compact!
-        links.sort_by { |link| [link[:order], link[:title]] }
+        links.flatten.compact.sort_by { |link| [link[:order], link[:title]] }
       end
 
       # Returns the database type (nucleotide or protein).

data/lib/sequenceserver/blast/job.rb

@@ -26,9 +26,9 @@ module SequenceServer
             @qfile     = store('query.fa', params[:sequence])
             @databases = Database[params[:databases]]
             @advanced  = params[:advanced].to_s.strip
-            @options   = @advanced + defaults
+            @num_threads = params[:num_threads] || config[:num_threads]
+            @options = @advanced + defaults
             # The following params are for analytics only
-            @num_threads = config[:num_threads]
             @query_length = calculate_query_size
             @number_of_query_sequences = calculate_number_of_sequences
             @databases_ncharacters_total = calculate_databases_ncharacters_total
@@ -62,8 +62,9 @@ module SequenceServer
       # Returns the command that will be executed. Job super class takes care
       # of actual execution.
       def command
-        @command ||= "#{method} -db '#{databases.map(&:name).join(' ')}'" \
-                     " -query '#{qfile}' #{options}"
+        "#{method} -db '#{databases.map(&:name).join(' ')}'" \
+                     " -query '#{qfile}' #{options}" \
+                     " -num_threads #{@num_threads || config[:num_threads]}"
       end
 
       def raise!
@@ -114,10 +115,11 @@ module SequenceServer
         validate_sequences params[:sequence]
         validate_databases params[:databases]
         validate_options params[:advanced]
+        validate_num_threads params[:num_threads]
       end
 
       def defaults
-        " -outfmt '11 qcovs qcovhsp' -num_threads #{config[:num_threads]}"
+        " -outfmt '11 qcovs qcovhsp'"
       end
 
       def validate_method(method)
@@ -159,6 +161,14 @@ module SequenceServer
         true
       end
 
+      # num_threads is interpolated unquoted into the shell command, so it
+      # must be a positive integer. nil means: use the configured default.
+      def validate_num_threads(num_threads)
+        return true if num_threads.nil? || num_threads.to_s.match?(/\A[1-9][0-9]*\z/)
+
+        fail InputError, 'num_threads should be a positive integer.'
+      end
+
       def allowed_chars
         /\A[a-z0-9\-_. ',]*\Z/i
       end

data/lib/sequenceserver/blast/report.rb

@@ -93,7 +93,11 @@ module SequenceServer
       def xml_ir
         @xml_ir ||=
           if job.imported_xml_file
-            parse_xml File.read(job.imported_xml_file)
+            parse_xml(File.read(job.imported_xml_file)).tap do |xml_ir|
+              if xml_ir.size < 9 || !xml_ir[0].is_a?(String) || !xml_ir[1].is_a?(String) || !xml_ir[7].is_a?(Array) || !xml_ir[8].is_a?(Array)
+                raise SequenceServer::XmlImportError
+              end
+            end
           else
             job.raise!
             parse_xml(xml_formatter.read_file)

data/lib/sequenceserver/database.rb

@@ -45,10 +45,14 @@ module SequenceServer
       cmd = "blastdbcmd -db #{name} -entry '#{accession}'"
 
       if coords
+        # The regex MUST be anchored (\A ... \z). An unanchored match would
+        # accept any string that merely *contains* a numeric range, letting an
+        # attacker smuggle shell metacharacters after it (e.g. "1-1;id") into
+        # the unquoted `-range` argument below, which `sys` runs via /bin/sh.
         fail(
           InvalidParameterError,
           "Invalid range coordinates: #{coords}"
-        ) unless coords =~ /[0-9]+-[0-9]*/
+        ) unless coords =~ /\A[0-9]+-[0-9]*\z/
 
         cmd << " -range #{coords}"
       end

data/lib/sequenceserver/job.rb

@@ -21,6 +21,14 @@ module SequenceServer
   # Singleton methods provide the facility to create and queue a job,
   # fetch a job or all jobs, and delete a job.
   class Job
+    # Job ids are used to build paths under DOTDIR and end up in shell
+    # commands, so only allow characters that are safe in both. Ids may have
+    # several path segments (test fixtures do), but no segment may start with
+    # a dot, which rules out '.', '..' and hidden directories, and the id may
+    # not start with '/', so it always stays inside DOTDIR.
+    ID_SEGMENT = '[a-zA-Z0-9_-][a-zA-Z0-9_.-]*'.freeze
+    ID_PATTERN = %r{\A#{ID_SEGMENT}(/#{ID_SEGMENT})*\z}
+
     class << self
       # Creates and queues a job. Returns created job object.
       def create(params)
@@ -40,6 +48,8 @@ module SequenceServer
 
       # Fetches job with the given id.
       def fetch(id)
+        return nil unless id.to_s.match?(ID_PATTERN)
+
         job_file = File.join(DOTDIR, id, 'job.yaml')
         return nil unless File.exist?(job_file)
 
@@ -86,17 +96,23 @@ module SequenceServer
     # Subclasses should extend `initialize` as per requirement.
     def initialize(params = {})
       @id = params.fetch(:id, SecureRandom.uuid)
+      # Validate before anything touches the filesystem: the rescue below
+      # removes `dir`, which must never be derived from a bad id.
+      fail ArgumentError, "Invalid job id: #{@id}" unless @id.to_s.match?(ID_PATTERN)
+
       @submitted_at = Time.now
-      mkdir_p dir
-      yield if block_given?
-      save
-    rescue Errno::ENOSPC
-      raise SystemError, 'Not enough disk space to start a new job'
-    rescue Errno::EACCES
-      raise SystemError, "Permission denied to write to #{DOTDIR}"
-    rescue StandardError => e
-      rm_rf dir
-      raise e
+      begin
+        mkdir_p dir
+        yield if block_given?
+        save
+      rescue Errno::ENOSPC
+        raise SystemError, 'Not enough disk space to start a new job'
+      rescue Errno::EACCES
+        raise SystemError, "Permission denied to write to #{DOTDIR}"
+      rescue StandardError => e
+        rm_rf dir
+        raise e
+      end
     end
 
     attr_reader :id, :submitted_at, :completed_at, :exitstatus

data/lib/sequenceserver/makeblastdb.rb

@@ -1,4 +1,5 @@
 require 'find'
+require 'shellwords'
 require 'forwardable'
 
 module SequenceServer
@@ -144,7 +145,7 @@ module SequenceServer
     # directory. Returns the output of `blastdbcmd`. This method is called
     # by `determine_formatted_fastas`.
     def blastdbcmd
-      cmd = "blastdbcmd -recursive -list #{config[:database_dir]}" \
+      cmd = "blastdbcmd -recursive -list #{Shellwords.escape(config[:database_dir])}" \
             ' -list_outfmt "%f	%t	%p	%n	%l	%d	%v"'
       out, err = sys(cmd, path: config[:bin])
       errpat = /BLAST Database error/

data/lib/sequenceserver/routes.rb

@@ -35,7 +35,9 @@ module SequenceServer
       # e.g. for example.org/our-sequenceserver set to '/our-sequenceserver'
       set :root_path_prefix, ''
 
-      set :search_layout, :'search_layout'
+      set :asset_prefix, ''
+
+      set :layout, :'layout'
     end
 
     # See
@@ -66,7 +68,7 @@ module SequenceServer
         secret: ENV.fetch('SESSION_SECRET') { SecureRandom.alphanumeric(64) }
       )
 
-      use Rack::Csrf, raise: true, skip: ['POST:/cloud_share']
+      use Rack::Csrf, raise: true, skip: ['POST:/cloud_share'] unless ENV['SKIP_CSRF_PROTECTION'] == 'true'
     end
 
     unless ENV['SEQUENCE_SERVER_COMPRESS_RESPONSES'] == 'false'
@@ -86,7 +88,7 @@ module SequenceServer
 
     # Returns base HTML. Rest happens client-side: rendering the search form.
     get '/' do
-      erb :search, layout: settings.search_layout
+      erb :search, layout: settings.layout
     end
 
     # Returns data that is used to render the search form client side. These
@@ -113,9 +115,9 @@ module SequenceServer
     post '/' do
       if params[:input_sequence]
         @input_sequence = params[:input_sequence]
-        erb :search, layout: settings.search_layout
+        erb :search, layout: settings.layout
       else
-        job = Job.create(params)
+        job = Job.create(job_params)
         redirect to("/#{job.id}")
       end
     end
@@ -143,7 +145,7 @@ module SequenceServer
       job = Job.fetch(jid)
       halt 404, File.read(File.join(settings.root, 'public/404.html')) if job.nil?
 
-      erb :report, layout: true
+      erb :report, layout: settings.layout
     end
     # @params sequence_ids: whitespace separated list of sequence ids to
     # retrieve
@@ -156,7 +158,7 @@ module SequenceServer
     # in identifiers) and retreival_databases (we don't allow whitespace in a
     # database's name, so it's safe).
     get '/get_sequence/' do
-      sequence_ids = params[:sequence_ids].to_s.split(',')
+      sequence_ids = params[:sequence_ids].to_s.split(',').uniq
       database_ids = params[:database_ids].to_s.split(',')
       if sequence_ids.empty?
         status 422
@@ -172,7 +174,7 @@ module SequenceServer
     end
 
     post '/get_sequence' do
-      sequence_ids = params['sequence_ids'].to_s.split(',')
+      sequence_ids = params['sequence_ids'].to_s.split(',').uniq
       database_ids = params['database_ids'].to_s.split(',')
 
       if sequence_ids.empty?
@@ -289,11 +291,9 @@ module SequenceServer
                              error.class.name
                            end
 
-      # If error object has a more_info method, use that. If the error does not
-      # have more_info, use backtrace.join("\n") as more_info.
-      if error.respond_to? :more_info
+      if error.respond_to?(:more_info)
         error_data[:more_info] = error.more_info
-      elsif error.respond_to? :backtrace
+      elsif error.respond_to?(:backtrace) && !settings.production?
         error_data[:more_info] = error.backtrace.join("\n")
       end
 
@@ -358,6 +358,18 @@ module SequenceServer
       def root_path_prefix
         settings.root_path_prefix.to_s
       end
+
+      def css_asset_path
+        File.join(settings.asset_prefix, 'css', 'app.min.css') + '?v=' + SequenceServer::VERSION
+      end
+
+      def asset_path(file)
+        File.join(settings.asset_prefix, file)
+      end
+
+      def asset_prefix
+        settings.asset_prefix
+      end
     end
 
     private
@@ -365,5 +377,18 @@ module SequenceServer
     def fetch_job(job_id)
       Job.fetch(job_id)
     end
+
+    # Only these request parameters may reach Job.create. Job#initialize and
+    # BLAST::Job#initialize also read :id, :xml and :num_threads, which end up
+    # in file paths and in the shell command, so they must never come from the
+    # request.
+    def job_params
+      {
+        method: params[:method],
+        sequence: params[:sequence],
+        databases: params[:databases],
+        advanced: params[:advanced]
+      }
+    end
   end
 end

data/lib/sequenceserver/version.rb

@@ -1,4 +1,4 @@
 # Define version number.
 module SequenceServer
-  VERSION = '3.1.3'.freeze
+  VERSION = '3.2.0'.freeze
 end

data/lib/sequenceserver/zip_file_generator.rb

@@ -23,7 +23,7 @@ class ZipFileGenerator
   def write
     entries = Dir.entries(@input_dir) - %w[. ..]
 
-    ::Zip::File.open(@output_file, ::Zip::File::CREATE) do |zipfile|
+    ::Zip::File.open(@output_file, create: true) do |zipfile|
       write_entries entries, '', zipfile
     end
   end

data/public/404.html

@@ -4,24 +4,16 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-
   <title>SequenceServer: Not Found</title>
-
-  <!-- Bootstrap CSS -->
-  <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet"
-    integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
+  <link rel="stylesheet" media="screen,print" type="text/css" href="css/app.min.css"/>
 </head>
 
-<body class="bg-light text-dark text-center">
-
-  <img src="/sequenceserver_logo.webp" alt="SequenceServer Logo" class="mt-5 mb-3" style="max-width: 200px;">
-
-  <div class="container" style="margin-top: 10%;">
-    <h1 class="display-4">404 Not Found</h1>
-    <p class="lead">Sorry, the page you are looking for could not be found.</p>
-    <a href="/" class="btn btn-primary mt-3">Start over</a>
+<body class="bg-white text-black text-center">
+  <img src="/sequenceserver_logo.webp" alt="SequenceServer Logo" class="mt-12 mb-4 w-48">
+  <div class="container mt-12">
+    <h1 class="text-4xl font-light leading-tight">404 Not Found</h1>
+    <p class="text-xl font-light mb-4">Sorry, the page you are looking for could not be found.</p>
+    <a href="/" class="py-2 px-4 rounded-md shadow-sm text-white bg-seqblue">Start over</a>
   </div>
-
 </body>
-
-</html>
+</html>