cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 00603add-7f72-448f-a6c0-9e456a7a3f94.md

title: Elasticsearch with HTTPS disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 00603add-7f72-448f-a6c0-9e456a7a3f94 Query name: Elasticsearch with HTTPS disabled Platform: Pulumi Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Amazon Elasticsearch does not have encryption for its domains enabled. To prevent such a scenario, update the attribute 'EnforceHTTPS' to true.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="31" name: aws runtime: yaml description: desc resources: type: aws.elasticsearch.Domain name: my-elasticsearch-domain properties: elasticsearchVersion: "7.9" elasticsearchClusterConfig: instanceType: "m5.large.elasticsearch" instanceCount: 1 ebsOptions: ebsEnabled: true volumeType: "gp2" volumeSize: 10 accessPolicies: | { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "es:*", "Resource": "arn:aws:es:${config.aws:region}:${aws:accountId}:domain/my-elasticsearch-domain/*" } ] } domainEndpointOptions: enforceHTTPS: false tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07" ``` ```yaml title="Negative test num. 1 - yaml file" name: aws runtime: yaml description: desc resources: type: aws.elasticsearch.Domain name: my-elasticsearch-domain properties: elasticsearchVersion: "7.9" elasticsearchClusterConfig: instanceType: "m5.large.elasticsearch" instanceCount: 1 ebsOptions: ebsEnabled: true volumeType: "gp2" volumeSize: 10 domainEndpointOptions: enforceHTTPS: true tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07" ```
Project: ClickHouse (App Definition and Development / Database)
File: v21.3.11.5-lts.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Support specifying table schema for postgresql dictionary source. Closes . (). Backported in : Fix SIGSEGV for external GROUP BY and overflow row (i.e. queries like `SELECT FROM GROUP BY WITH TOTALS SETTINGS maxbytesbeforeexternalgroupby>0, maxrowstogroupby>0, groupbyoverflowmode='any', totalsmode='beforehaving'`). (). Backported in : Fix crash in MergeJoin, close . ().
Project: KICS (Provisioning / Security & Compliance)
File: f11aec39-858f-4b6f-b946-0a1bf46c0c87.md

title: DAX Cluster Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f11aec39-858f-4b6f-b946-0a1bf46c0c87 Query name: DAX Cluster Not Encrypted Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AWS DAX Cluster should have server-side encryption at rest<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 14 25" resource "awsdaxcluster" "bar_1" { cluster_name = "cluster-example" iamrolearn = data.awsiamrole.example.arn node_type = "dax.r4.large" replication_factor = 1 } resource "awsdaxcluster" "bar_2" { cluster_name = "cluster-example" iamrolearn = data.awsiamrole.example.arn node_type = "dax.r4.large" replication_factor = 1 serversideencryption { } } resource "awsdaxcluster" "bar_3" { cluster_name = "cluster-example" iamrolearn = data.awsiamrole.example.arn node_type = "dax.r4.large" replication_factor = 1 serversideencryption { enabled = false } } ``` ```tf title="Negative test num. 1 - tf file" resource "awsdaxcluster" "bar" { cluster_name = "cluster-example" iamrolearn = data.awsiamrole.example.arn node_type = "dax.r4.large" replication_factor = 1 serversideencryption { enabled = true } } ```
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.184.md

layout: release date: 2023-11-29 tag: v0.6.184 [bug] Update config.js @theBeginner86 (#9486) [bug] Update config.js @theBeginner86 (#9486) Thank you to our contributors for making this release possible: @aabidsofi19, @leecalcote and @theBeginner86
Project: ArangoDB (App Definition and Development / Database)
File: co_try_failure_likely.md

+++ title = "`BOOSTOUTCOMECOTRYFAILURE_LIKELY(var, expr)`" description = "Evaluate within a coroutine an expression which results in an understood type, assigning `T` to a decl called `var` if successful, immediately returning `tryoperationreturn_as(X)` from the calling function if unsuccessful." +++ Evaluate within a coroutine an expression which results in a type matching the following customisation points, assigning `T` to a decl called `var` if successful, immediately returning {{% api "tryoperationreturn_as(X)" %}} from the calling function if unsuccessful: `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationhasvalue(X)" %}} `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationreturnas(X)" %}} `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationextractvalue(X)" %}} Default overloads for these customisation points are provided. See . Hints are given to the compiler that the expression will be unsuccessful. If you expect success, you should use {{% api "BOOSTOUTCOMECO_TRY(var, expr)" %}} instead. An internal temporary to hold the value of the expression is created, which generally invokes a copy/move. Overridable: Not overridable. Definition: See {{% api "BOOSTOUTCOMECO_TRYV(expr)" %}} for most of the mechanics. If successful, `var` is initialised or assigned to the expression result's `.assume_value()` if available, else to its `.value()`. This binds a reference possibly to the `T` stored inside the bound result of the expression, but possibly also to a temporary emitted from the value observer function. Header: `<boost/outcome/try.hpp>` Legacy: Before Outcome v2.2, `var` was always declared as an automatic rvalue ref. You can use the backwards compatibility macro `OUTCOME21COTRY()` if wish to retain the old behaviour.
Project: ArangoDB (App Definition and Development / Database)
File: co_tryx.md

+++ title = "`BOOSTOUTCOMECO_TRYX(expr)`" description = "Evaluate from within a coroutine an expression which results in an understood type, emitting the `T` if successful, immediately returning `tryoperationreturn_as(X)` from the calling function if unsuccessful." +++ Evaluate within a coroutine an expression which results in a type matching the following customisation points, emitting the `T` if successful, immediately returning {{% api "tryoperationreturn_as(X)" %}} from the calling function if unsuccessful: `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationhasvalue(X)" %}} `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationreturnas(X)" %}} `BOOSTOUTCOMEV2NAMESPACE::`{{% api "tryoperationextractvalue(X)" %}} Default overloads for these customisation points are provided. See . Hints are given to the compiler that the expression will be successful. If you expect failure, you should use {{% api "BOOSTOUTCOMECOTRYXFAILURE_LIKELY(expr)" %}} instead. An internal temporary to hold the value of the expression is created, which generally invokes a copy/move. Availability: GCC and clang only. Use `#ifdef BOOSTOUTCOMECO_TRYX` to determine if available. Overridable: Not overridable. Definition: See {{% api "BOOSTOUTCOMECO_TRYV(expr)" %}} for most of the mechanics. This macro makes use of a proprietary extension in GCC and clang to emit the `T` from a successful expression. You can thus use `BOOSTOUTCOMECOTRYX(expr)` directly in expressions e.g. `auto x = y + BOOSTOUTCOMECOTRYX(foo(z));`. Be aware there are compiler quirks in preserving the rvalue/lvalue/etc-ness of emitted `T`'s, specifically copy or move constructors may be called unexpectedly and/or copy elision not work as expected. If these prove to be problematic, use {{% api "BOOSTOUTCOMECO_TRY(var, expr)" %}} instead. Header: `<boost/outcome/try.hpp>`
Project: YugabyteDB (App Definition and Development / Database)
File: drop_foreign_table.diagram.md

<svg class="rrdiagram" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" width="622" height="70" viewbox="0 0 622 70"><path class="connector" d="M0 22h15m53 0h10m75 0h10m58 0h30m32 0h10m64 0h20m-141 0q5 0 5 5v8q0 5 5 5h116q5 0 5-5v-8q0-5 5-5m5 0h10m91 0h30m77 0h22m-109 25q0 5 5 5h5m79 0h5q5 0 5-5m-104-25q5 0 5 5v33q0 5 5 5h89q5 0 5-5v-33q0-5 5-5m5 0h15"/><polygon points="0,29 5,22 0,15" style="fill:black;stroke-width:0"/><rect class="literal" x="15" y="5" width="53" height="25" rx="7"/><text class="text" x="25" y="22">DROP</text><rect class="literal" x="78" y="5" width="75" height="25" rx="7"/><text class="text" x="88" y="22">FOREIGN</text><rect class="literal" x="163" y="5" width="58" height="25" rx="7"/><text class="text" x="173" y="22">TABLE</text><rect class="literal" x="251" y="5" width="32" height="25" rx="7"/><text class="text" x="261" y="22">IF</text><rect class="literal" x="293" y="5" width="64" height="25" rx="7"/><text class="text" x="303" y="22">EXISTS</text><a xlink:href="../../../syntaxresources/grammardiagrams#table-name"><rect class="rule" x="387" y="5" width="91" height="25"/><text class="text" x="397" y="22">table_name</text></a><rect class="literal" x="508" y="5" width="77" height="25" rx="7"/><text class="text" x="518" y="22">CASCADE</text><rect class="literal" x="508" y="35" width="79" height="25" rx="7"/><text class="text" x="518" y="52">RESTRICT</text><polygon points="618,29 622,29 622,15 618,15" style="fill:black;stroke-width:0"/></svg>
Project: Sonobuoy (Provisioning / Security & Compliance)
File: 01-cis-benchmark.md

title: CIS Benchmarks link: https://github.com/vmware-tanzu/sonobuoy-plugins/tree/main/cis-benchmarks This plugin utilizes the kube-bench implementation of the CIS security benchmarks. It is technically two plugins; one to run the checks on the master nodes and another to run the checks on the worker nodes.
Project: SPIFFE (Provisioning / Key Management)
File: FREDERICK_KAUTZ.md

Frederick Kautz is an exceptional leader with an extensive background in the Open Source Community. With over a decade of experience in Cloud-Native environments, Fredericks expertise lies in security, networking, and storage domains. He has co-authored several publications, including the Cloud Native Security White Paper and Solving the Bottom Turtle. As a Co-Chair for KubeCon + CloudNativeCon and a member of the SPIFFE Steering Committee, Frederick is at the forefront of the industry, providing Zero Trust Workload Identity to compute workloads and resources. Frederick has co-created multiple innovative projects, most recently OmniBOR and its Golang and Rust reference implementations. Frederick is also a co-founder and maintainer of Network Service Mesh. His work in Network Service Mesh has helped to modernize network infrastructure and collaborate with a large and diverse group of companies and individuals. Fredericks prior work defined the Cloud-Native Network Function, which significantly influences multiple significant collaborations, including CNCF, LFN, IEEE, and the GSMA. Additionally, Frederick is a strong advocate for empowering patients ownership of their health data and democratizing healthcare research. He has pioneered Federated Learning and privacy-preserving technologies, which enable multiple organizations and patients to collaborate without exposing sensitive data to each other. Frederick co-chairs the CTA ANSI/CTA-2114: Mitigating Cybersecurity Threats in ML-Based Systems Committee. He leads multiple cross-organizational teams to develop industry standards for security and privacy in Machine Learning. GitHub Handle: fkautz Email Address: frederick@kautz.dev LinkedIn Profile: https://www.linkedin.com/in/fkautz/ Current Affiliation: N/A (unable to use current affiliation name)
Project: ClickHouse (App Definition and Development / Database)
File: clickhouse-obfuscator.md

slug: /en/operations/utilities/clickhouse-obfuscator title: clickhouse-obfuscator A simple tool for table data obfuscation. It reads an input table and produces an output table, that retains some properties of input, but contains different data. It allows publishing almost real production data for usage in benchmarks. It is designed to retain the following properties of data: cardinalities of values (number of distinct values) for every column and every tuple of columns; conditional cardinalities: number of distinct values of one column under the condition on the value of another column; probability distributions of the absolute value of integers; the sign of signed integers; exponent and sign for floats; probability distributions of the length of strings; probability of zero values of numbers; empty strings and arrays, `NULL`s; data compression ratio when compressed with LZ77 and entropy family of codecs; continuity (magnitude of difference) of time values across the table; continuity of floating-point values; date component of `DateTime` values; UTF-8 validity of string values; string values look natural. Most of the properties above are viable for performance testing: reading data, filtering, aggregation, and sorting will work at almost the same speed as on original data due to saved cardinalities, magnitudes, compression ratios, etc. It works in a deterministic fashion: you define a seed value and the transformation is determined by input data and by seed. Some transformations are one to one and could be reversed, so you need to have a large seed and keep it in secret. It uses some cryptographic primitives to transform data but from the cryptographic point of view, it does not do it properly, that is why you should not consider the result as secure unless you have another reason. The result may retain some data you don't want to publish. It always leaves 0, 1, -1 numbers, dates, lengths of arrays, and null flags exactly as in source data. For example, you have a column `IsMobile` in your table with values 0 and 1. In transformed data, it will have the same value. So, the user will be able to count the exact ratio of mobile traffic. Let's give another example. When you have some private data in your table, like user email, and you don't want to publish any single email address. If your table is large enough and contains multiple different emails and no email has a very high frequency than all others, it will anonymize all data. But if you have a small number of different values in a column, it can reproduce some of them. You should look at the working algorithm of this tool works, and fine-tune its command line parameters. This tool works fine only with at least a moderate amount of data (at least 1000s of rows).
Project: deepstream (App Definition and Development / Streaming & Messaging)
File: bug_report.md

name: Bug report about: Create a report to help us improve title: '' labels: '' assignees: '' Describe the bug A clear and concise description of what the bug is. To Reproduce Steps to reproduce the behavior: Go to '...' Click on '....' Scroll down to '....' See error Expected behavior A clear and concise description of what you expected to happen. Screenshots If applicable, add screenshots to help explain your problem. Server version Protocol (binary or text) Websocket server (node-http or uws) Server OS Node version Server config Please share the config sections that might be relevant for this issue Client (Js, Java, other) and client version Client config Please share the config sections that might be relevant for this issue Additional context Add any other context about the problem here.
Project: Plural (App Definition and Development / Application Definition & Image Build)
File: README.md

Plural is a multi-tenant kubernetes app delivery platform. It has as subcomponents: postgres db rabbitmq cluster rtc, api, and background worker deployments chartmuseum docker registry ``` helm repo add plural https://app.plural.sh/cm/plural ``` ``` helm upgrade --install plural plural/plural ``` (It's highly recommend you utilize plural to generate the initial configuration for you based on the environment you're deploying to) ```yaml postgresql: postgresqlPassword: supercomplicatedrandombytes secrets: jwt: alsosupercomplicatedrandombytes erlang: stillusesupercomplicatedrandombytes ingress: dns: my.forge.domain api: bucket: assets-for-forge chartmuseum: bucket: bucket-for-chartmuseum admin: enabled: true name: "Michael Guarino" email: mguarino46@gmail.com password: "a very strong password" publisher: michaeljguarino publisher_description: "A collection of my personal projects" ``` | Parameter | Description | Default | | | -- | - | | replicaCount | number of api replicas | 2 | | api.bucket | the bucket to use for images | forge-assets | | chartmuseum.bucket | the bucket for charts | forge-charts | | ingress.dns | the dns name to register under | forge.piazza.app | | ingress.enabled | whether to provision an ingress | true |
Project: KICS (Provisioning / Security & Compliance)
File: ccc98ff7-68a7-436e-9218-185cb0b0b780.md

title: Service Account Private Key File Not Defined hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ccc98ff7-68a7-436e-9218-185cb0b0b780 Query name: Service Account Private Key File Not Defined Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: When using kube-controller-manager commands, the '--service-account-private-key-file' should be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager"] args: ["--service-account-private-key-file=/path/to/key/file.pem"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager","--service-account-private-key-file=/path/to/key/file.pem"] args: [] restartPolicy: OnFailure ```
Project: KICS (Provisioning / Security & Compliance)
File: 02d9c71f-3ee8-4986-9c27-1a20d0d19bfc.md

title: Unpinned Package Version in Pip Install hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 02d9c71f-3ee8-4986-9c27-1a20d0d19bfc Query name: Unpinned Package Version in Pip Install Platform: Dockerfile Severity: <span style="color:#ff7213">Medium</span> Category: Supply-Chain URL: Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="18 3 4 15" FROM alpine:3.9 RUN apk add --update py-pip=7.1.2-r0 RUN pip install --user pip RUN ["pip", "install", "connexion"] COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 ENV TEST="test" CMD ["python", "/usr/src/app/app.py"] FROM alpine:3.7 RUN apk add --update py-pip=7.1.2-r0 RUN pip install connexion COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt RUN pip3 install requests COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python"] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM alpine:3.4 RUN apk add --update py-pip=7.1.2-r0 RUN sudo pip install --upgrade pip=20.3 connexion=2.7.0 COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] FROM alpine:3.1 RUN apk add py-pip=7.1.2-r0 RUN sudo pip install --upgrade pip=20.3 connexion=2.7.0 COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt RUN pip3 install requests=2.7.0 COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ``` ```dockerfile title="Negative test num. 2 - dockerfile file" FROM alpine:3.4 RUN apk add --update py-pip=7.1.2-r0 RUN pip3 install -r pip_requirements.txt COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ``` ```dockerfile title="Negative test num. 3 - dockerfile file" FROM alpine:3.4 RUN apk add --update py-pip=7.1.2-r0 RUN pip3 install -c constraints.txt COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ```
Project: KICS (Provisioning / Security & Compliance)
File: efbf148a-67e9-42d2-ac47-02fa1c0d0b22.md

title: Shell Running A Pipe Without Pipefail Flag hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: efbf148a-67e9-42d2-ac47-02fa1c0d0b22 Query name: Shell Running A Pipe Without Pipefail Flag Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Insecure Defaults URL: Check if shell commands with pipes (except Powershell) have the pipefail flag set (-o).<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="2 3" FROM node:12 RUN zsh ./someoutput | ./somescript RUN [ "/bin/bash", "./someoutput", "|", "./somescript" ] ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM node:12 RUN pwsh SOMECMD | SOMEOTHER_CMD SHELL [ "zsh", "-o","pipefail" ] RUN zsh ./someoutput | ./somescript SHELL [ "/bin/bash", "-o","pipefail" ] RUN [ "/bin/bash", "./someoutput", "./somescript" ] ```
Project: StarRocks (App Definition and Development / Database)
File: hll_union.md

displayed_sidebar: "English" Returns the concatenation of a set of HLL values. ```Haskell hll_union(hll) ``` ```Plain mysql> select k1, hllcardinality(hllunion(v1)) from tbl group by k1; ++-+ | k1 | hllcardinality(hllunion(`v1`)) | ++-+ | 2 | 4 | | 1 | 3 | ++-+ ```
Project: Open Policy Agent (OPA) (Provisioning / Security & Compliance)
File: feature_request.md

name: Feature request about: Let us know how we could improve OPA title: '' labels: feature-request assignees: '' <!-- Thanks for opening an issue to request a feature or file a bug! If you provide some basic information, it helps us address problems faster. --> <!-- By making this change, what are you hoping to improve or fix? Why would this change make the OPA experience better? Are there any current solutions that are inefficient or frustrating? --> <!-- In the ideal scenario, there are more than enough resources to solve any problem. Describe what this solution would look like if the resources were available. --> <!-- In a more realistic world, we have limited time and resources to solve a problem. Describe what a minimum viable solution would look like that still satisfies the requirements. Think about what is a must-have and what is a nice-to-have; now list out the must-haves. Is there an alternate solution that would work just as well? --> <!-- Add in additional information that would help. Do you have links to similar solutions, screenshots of a problem, or mockups of a solution? -->