Using the proper commandline to generate sha256 checksum of files. Added autoescaping to the Jinja2 templates in response to semgrep results.

.github/workflows/validate-and-build.yml

@@ -231,10 +231,10 @@ jobs:
           slim package -o upload DA-ESS_AmazonWebServices_Content
 
           cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
-          sha256 DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
+          sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
 
           cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz
-          sha256 DA-ESS_AmazonWebServices_Content-latest.tar.gz > checksum.txt
+          sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz > checksum.txt
 
       - name: store_artifacts
         uses: actions/upload-artifact@v2

automated_detection_testing/detection_service.py

@@ -10,7 +10,7 @@ import boto3
 from random import randrange
 import yaml
 from github import Github
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import Environment, FileSystemLoader, select_autoescape
 import base64
 from botocore.exceptions import ClientError
 import json
@@ -41,7 +41,8 @@ def main(args):
     parser.add_argument("-s3b", "--s3_bucket", required=False, default="attack-range-automated-testing",
                         help="S3 bucket to store the test data")
 
-
+    select_autoescape(default_for_string=True, default=True)
+    
     args = parser.parse_args()
     test_file_name = args.test_file_name
     attack_range_repo = args.attack_range_repo

bin/doc_gen.py

@@ -5,7 +5,7 @@ import sys
 import re
 from os import path, walk
 import json
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import Environment, FileSystemLoader, select_autoescape
 import datetime
 from stix2 import FileSystemSource
 from stix2 import Filter
@@ -253,12 +253,14 @@ if __name__ == "__main__":
     parser.add_argument("-o", "--output", required=True, help="path to the output directory for the docs")
     parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
 
+    
     # parse them
     args = parser.parse_args()
     REPO_PATH = args.path
     OUTPUT_DIR = args.output
     VERBOSE = args.verbose
 
+    select_autoescape(default_for_string=True, default=True)
     TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
 
     if VERBOSE:

bin/generate.py

@@ -10,7 +10,7 @@ import argparse
 from os import path
 import sys
 import datetime
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import Environment, FileSystemLoader, select_autoescape
 import re
 from attackcti import attack_client
 import csv
@@ -625,6 +625,7 @@ def get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
 
 def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
 
+    select_autoescape(default_for_string=True, default=True)
     TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
 
     objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
@@ -678,6 +679,7 @@ if __name__ == "__main__":
     parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
     parser.add_argument("--product", required=True, default="ESCU", help="package type")
 
+    
     # parse them
     args = parser.parse_args()
     REPO_PATH = args.path

bin/newcontent.py

@@ -8,13 +8,15 @@ from pathlib import Path
 from PyInquirer import prompt, Separator
 import os
 import getpass
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import Environment, FileSystemLoader, select_autoescape
 import uuid
 from datetime import date
 from os import path
 import sys
 
 
+select_autoescape(default_for_string=True, default=True)
+
 def detection_wizard(security_content_path,type,TEMPLATE_PATH):
     questions = [
         {

bin/reporting.py

@@ -7,7 +7,7 @@ import os
 from os import path
 import sys
 import datetime
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import Environment, FileSystemLoader, select_autoescape
 
 
 def load_objects(file_path, REPO_PATH):
@@ -65,6 +65,7 @@ def main(args):
 
     print("detection_coverage {}".format(detection_coverage))
 
+    select_autoescape(default_for_string=True, default=True)
     TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
     OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting')
     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True)