cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 8055dec2-efb8-4fe6-8837-d9bed6ff202a.md

title: User With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction' hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8055dec2-efb8-4fe6-8837-d9bed6ff202a Query name: User With Privilege Escalation By Actions 'lambda:CreateFunction' And 'iam:PassRole' And 'lambda:InvokeFunction' Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction' and Resource set to '*'. For more information see https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awsiamuser" "cosmic" { name = "cosmic" } resource "awsiamuserpolicy" "testinline_policy" { name = "testinlinepolicy" user = awsiamuser.cosmic.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "lambda:CreateFunction", "lambda:InvokeFunction" ] Effect = "Allow" Resource = "*" }, ] }) } resource "awsiampolicy_attachment" "test-attach" { name = "test-attachment" users = [awsiamuser.cosmic.name] roles = [awsiamrole.role.name] groups = [awsiamgroup.group.name] policyarn = awsiam_policy.policy.arn } resource "awsiampolicy" "policy" { name = "test-policy" description = "A test policy" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "iam:PassRole", ] Effect = "Allow" Resource = "*" }, ] }) } ``` ```tf title="Negative test num. 1 - tf file" resource "awsiamuser" "cosmic2" { name = "cosmic2" } resource "awsiamuserpolicy" "inlinepolicyruninstances2" { name = "inlinepolicyrun_instances" user = awsiamuser.cosmic2.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "ec2:Describe*", ] Effect = "Allow" Resource = "*" }, ] }) } ```
Project: KICS (Provisioning / Security & Compliance)
File: c606ba1d-d736-43eb-ac24-e16108f3a9e0.md

title: IP Aliasing Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c606ba1d-d736-43eb-ac24-e16108f3a9e0 Query name: IP Aliasing Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Kubernetes Clusters must be created with Alias IP ranges enabled, which means the attribut 'ipallocationpolicy' must be defined and, if defined, the attribute 'networkingmode' must be VPCNATIVE <br> ```tf title="Positive test num. 1 - tf file" hl_lines="2 26 13" resource "googlecontainercluster" "positive1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive2" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 networkingmode = "VPCNATIVE" timeouts { create = "30m" update = "40m" } } resource "googlecontainercluster" "positive3" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 ipallocationpolicy { } networking_mode = "ROUTES" timeouts { create = "30m" update = "40m" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecontainercluster" "negative1" { name = "marcellus-wallace" location = "us-central1-a" initialnodecount = 3 ipallocationpolicy { } networkingmode = "VPCNATIVE" timeouts { create = "30m" update = "40m" } } ```
Project: FOSSA (Provisioning / Security & Compliance)
File: erlang.md

When developing in Erlang, is the most common package manager. Dependencies are specified in a manifest file by users which is used by the `rebar3` tool to build a dependency graph and download the correct dependencies. | Strategy | Direct Deps | Transitive Deps | Edges | Container Scanning | | -- | | | | | | rebar3 | :whitecheckmark: | :whitecheckmark: | :whitecheckmark: | :x: | In order to find Rebar projects, we look for `rebar.config` files which specify the root of a Rebar project. Once we find a `rebar.config` file we quit walking the file tree because the downloaded dependencies will have their own `rebar.config` files in subdirectories. run `rebar3 tree -v` and generate output similar to: ``` one1.0.0 (https://github.com/dep/one) two2.0.0 (hex package) three3.0.0 (hex package) four4.0.0 (https://github.com/dep/four) five5.0.0 (hex package) ``` Parse this output to determine the dependency graph and the locations of each dependency. `rebar.config` allows users to alias dependencies in a format similar to `{deps, [{chatterbox, {pkg, ts_chatterbox}},`. This format is not currently handled in the CLI and will result in unknown dependencies being shown in the FOSSA UI. The team is aware of this limitation and a fix is planned.
Project: Gradle Build Tool (App Definition and Development / Application Definition & Image Build)
File: Module.md

Gradles Kotlin DSL provides an enhanced editing experience in supported IDEs, with superior content assistance, refactoring, documentation, and more. For an introduction see the <a href="../userguide/kotlin_dsl.html">Kotlin DSL Primer</a>. The Kotlin DSL is implemented on top of Gradles Java API. Many of the objects, functions, and properties you use in your build scripts come from the Gradle API and the APIs of the applied plugins. This reference covers both the Kotlin DSL and the Java API, but it doesn't include functionality provided by external plugins. The main package of the Kotlin DSL is <a href="./gradle/org.gradle.kotlin.dsl/index.html">org.gradle.kotlin.dsl</a>. All members of this package are implicitly imported and readily available in `.gradle.kts` scripts in addition to the Java API <a href="../userguide/writingbuildscripts.html#script-default-imports">default imports</a>. The `org.gradle.kotlin.dsl` package contains the Gradle Kotlin DSL public API. All members of this package are implicitly imported and readily available in `.gradle.kts` scripts in addition to the Gradle Java API <a href="../../../userguide/writingbuildscripts.html#script-default-imports">default imports</a>.
Project: Beam (App Definition and Development / Streaming & Messaging)
File: ibiblio.md

title: "iBiblio" icon: /images/logos/powered-by/ibiblio.png hasLink: "https://www.ibiblio.org/" <!-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. -->
Project: Kui (App Definition and Development / Application Definition & Image Build)
File: kui_shell_core.Event.md

/ / Event .Event `Optional` command: `string` `Optional` error: `string` `Optional` execType: `Optional` isDrilldown: `boolean` `Optional` isIntention: `boolean` `Optional` options: `string`[] `Optional` plugin: `string` `Optional` route: `string` `Optional` tab:
Project: Devfile (App Definition and Development / Application Definition & Image Build)
File: feature_request.md

name: Feature request about: Suggest an idea for this project title: '' labels: '' assignees: '' <!-- Welcome! - We kindly ask you to: Fill out the issue template below Use the Devfile Community Slack Channel: https://kubernetes.slack.com/archives/C02SX9E5B55 if you have a question rather than a bug or feature request. If you havent joined the Kubernetes workspace before, follow https://slack.k8s.io/. Thanks for understanding and for contributing to the project! --> <!-- Uncomment appropriate `/area` lines, and delete the rest. For example, `> /area api` would simply become: `/area api` --> /area ci /area api /area library /area registry /area alizer /area devworkspace /area integration-tests /area test-automation /area releng /area documentation /area landing-page <!-- A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] --> Why is this needed? Is your feature request related to a problem? Detailed description: <!-- A clear and concise description of what you want to happen. --> <!-- A clear and concise description of any alternative solutions or features you've considered. --> <!-- Add any other context or screenshots about the feature request here. -->
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-image-scp.1.md

% podman-image-scp 1 podman-image-scp - Securely copy an image from one host to another podman image scp [options] name[:tag] podman image scp copies container images between hosts on a network. This command can copy images to the remote host or from the remote host as well as between two remote hosts. Note: `::` is used to specify the image name depending on Podman is saving or loading. Images can also be transferred from rootful to rootless storage on the same machine without using sshd. This feature is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. podman image scp [GLOBAL OPTIONS] podman image scp [OPTIONS] NAME[:TAG] [HOSTNAME::] podman image scp [OPTIONS] [HOSTNAME::]IMAGENAME podman image scp [OPTIONS] [HOSTNAME::]IMAGENAME [HOSTNAME::] Print usage statement Suppress the output Copy specified image to local storage: ``` $ podman image scp alpine Loaded image: docker.io/library/alpine:latest ``` Copy specified image from local storage to remote connection: ``` $ podman image scp alpine Fedora::/home/charliedoern/Documents/alpine Getting image source signatures Copying blob 72e830a4dff5 done Copying config 85f9dc67c7 done Writing manifest to image destination Storing signatures Loaded image: docker.io/library/alpine:latest ``` Copy specified image from remote connection to remote connection: ``` $ podman image scp Fedora::alpine RHEL:: Loaded image: docker.io/library/alpine:latest ``` Copy specified image via ssh to local storage: ``` $ podman image scp charliedoern@192.168.68.126:22/run/user/1000/podman/podman.sock::alpine WARN[0000] Unknown connection name given. Please use system connection add to specify the default remote socket location Getting image source signatures Copying blob 9450ef9feb15 [--] 0.0b / 0.0b Copying config 1f97f0559c done Writing manifest to image destination Storing signatures Loaded image: docker.io/library/alpine:latest ``` Copy specified image from root account to user accounts local storage: ``` $ sudo podman image scp root@localhost::alpine username@localhost:: Copying blob e2eb06d8af82 done Copying config 696d33ca15 done Writing manifest to image destination Storing signatures Getting image source signatures Copying blob 5eb901baf107 skipped: already exists Copying config 696d33ca15 done Writing manifest to image destination Storing signatures Loaded image: docker.io/library/alpine:latest ``` Copy specified image from root account to local storage: ``` $ sudo podman image scp root@localhost::alpine Copying blob e2eb06d8af82 done Copying config 696d33ca15 done Writing manifest to image destination Storing signatures Getting image source signatures Copying blob 5eb901baf107 Copying config 696d33ca15 done Writing manifest to image destination Storing signatures Loaded image: docker.io/library/alpine:latest ``` , , , , , , July 2021, Originally written by Charlie Doern <cdoern@redhat.com>
Project: external-secrets (Provisioning / Security & Compliance)
File: password.md

The Password generator provides random passwords that you can feed into your applications. It uses lower and uppercase alphanumeric characters as well as symbols. Please see below for the symbols in use. !!! warning "Passwords are completely randomized" It is possible that we may generate passwords that don't match the expected character set from your application. | Key | Description | | -- | - | | password | the generated password | You can influence the behavior of the generator by providing the following args | Key | Default | Description | | - | - | | | length | 24 | Length of the password to be generated. | | digits | 25% of the length | Specify the number of digits in the generated password. | | symbols | 25% of the length | Specify the number of symbol characters in the generated. | | symbolCharacters | ~!@#$%^&\*()\_+`-={}\|[]\\:"<>?,./ | Specify the character set that should be used when generating the password. | | noUpper | false | disable uppercase characters. | | allowRepeat | false | allow repeating characters. | ```yaml {% include 'generator-password.yaml' %} ``` Example `ExternalSecret` that references the Password generator: ```yaml {% include 'generator-password-example.yaml' %} ``` Which will generate a `Kind=Secret` with a key called 'password' that may look like: ``` RMngCHKtZ@@h@3aja$WZDuDVhkCkN48JBa9OF8jH$R VB$pX8SSUMIlk9K8g@XxJAhGz$0$ktbJ1ArMukg-bD Hi$-aK_3Rrrw1Pj9-sIpPZuk5abvEDJlabUYUcS$9L ``` With default values you would get something like: ``` 2Cp=O*&8x6sdwM!<74G_gUz5 -MS`e#n24K|h5A<&6q9Yv7Cj ZRv-k!y6x/V"29:43aErSf$1 Vk9*mwXE30Q+>H?lY$5I64_q ```
Project: YugabyteDB (App Definition and Development / Database)
File: yba_universe_node_remove.md

Remove a node instance to YugabyteDB Anywhere universe Remove a node instance from YugabyteDB Anywhere universe and move its data out. The same instance is not expected to be used for this cluster again. ``` yba universe node remove [flags] ``` ``` -h, --help help for remove ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -n, --name string [Required] The name of the universe for the corresponding node operations. --node-name string [Optional] The name of the universe node for the corresponding node operations. Required for add, reboot, release, remove, reprovision, start, stop. -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Manage YugabyteDB Anywhere universe nodes
Project: Shifu (Provisioning / Automation & Configuration)
File: steps.md

To start MQTT broker in local machine: ```bash sudo apt-add-repository ppa:mosquitto-dev/mosquitto-ppa sudo apt-get install mosquitto mosquitto-clients ``` edit `/etc/mosquitto/conf.d/mosquitto.conf`: ``` listener 1883 0.0.0.0 allow_anonymous true log_dest stdout ``` restart mosquitto service: ```bash sudo service mosquitto restart ``` Deploy the MQTT broker in Kubernetes: ```bash kubectl apply -f /shifu/examples/mqttDeviceShifu/mqtt_broker kubectl port-forward svc/mosquitto-service -n devices 1883:1883 --address='0.0.0.0' ``` Deploy MQTT deviceshifu YAMLs: ```bash kubectl apply -f examples/mqttDeviceShifu/mqtt_deploy/ ``` Publish some ramdom data to the topic: ```bash mosquitto_pub -h 172.28.15.229 -d -p 1883 -t /test/test -m "test2333" ``` Test using an nginx pod ```bash kubectl run nginx --image=nginx -n deviceshifu kubectl -n deviceshifu exec -it nginx -- bash curl deviceshifu-mqtt/mqtt_data ``` output: ```bash root@nginx:/# curl deviceshifu-mqtt/mqtt_data {"mqttmessage":"test2333","mqttreceive_timestamp":"2022-04-29 08:57:49.9492744 +0000 UTC m=+75.407609501"} ``` For debugging, subscribe to your machine's IP (change accordingly): ```bash mosquitto_sub -h 172.28.15.229 -p 1883 -t /test/test -d ```
Project: StarRocks (App Definition and Development / Database)
File: min_by.md

displayed_sidebar: "English" Returns the value of `x` associated with the minimum value of `y`. For example, `SELECT minby(subject, examresult) FROM exam;` is to return the subject that has the lowest exam score. This function is supported from v2.5. ```Haskell min_by(x,y) ``` `x`: an expression of any type. `y`: an expression of a type that can be ordered. Returns a value that has the same type as `x`. `y` must be a sortable type. If you use an unsortable type of `y`, such as `bitmap` or `hll`, an error is returned. If `y` contains a null value, the row that corresponds to the null value is ignored. If more than one value of `x` has the same minimum value of `y`, this function returns the first value of `x` encountered. Create a table `exam`. ```SQL CREATE TABLE exam ( subject_id INT, subject STRING, exam_result INT ) DISTRIBUTED BY HASH(`subject_id`); ``` Insert values into this table and query data from this table. ```SQL insert into exam values (1,'math',90), (2,'english',70), (3,'physics',95), (4,'chemistry',85), (5,'music',95), (6,'biology',null); select * from exam order by subject_id; ++--+-+ | subjectid | subject | examresult | ++--+-+ | 1 | math | 90 | | 2 | english | 70 | | 3 | physics | 95 | | 4 | chemistry | 85 | | 5 | music | 95 | | 6 | biology | null | ++--+-+ 6 rows in set (0.03 sec) ``` Obtain the subject that has the lowest score. The subject `english` that has the lowest score `70` is returned. ```Plain SELECT minby(subject, examresult) FROM exam; ++ | minby(subject, examresult) | ++ | english | ++ 1 row in set (0.01 sec) ```
Project: SlimToolkit (Provisioning / Security & Compliance)
File: ISSUE_TEMPLATE.md

Expected Behavior ================= Actual Behavior ================= Steps to Reproduce the Problem =============================== <! Open an issue and provide enough cotext information to repro the condition. Don't worry if it's not possible to reproduce (reliably). Submit an issue anyways including the information you do have. The version information should be provided in all bug reports. --> 1. Specifications ================= Version: Platform:
Project: Harbor (Provisioning / Container Registry)
File: 2-01-DB-user-create-project.md

Test 2-01 - User Create Project (DB Mode) ======= To verify that a non-admin user can create projects when users are managed locally by Harbor (DB mode). User guide This test requires that a Harbor instance is running and available. Harbor is set to authenticate against a local database. ( auth_mode is set to db_auth* .) The user data is stored in a local database. A linux host with Docker CLI installed (Docker client). At least two non-admin users are in Harbor. NOTE: In below test, user A and B are non-admin users. User A, B and project X, Y should be replaced by longer and meaningful names. Log in to UI as user A (non-admin). Create a new project X with publicity is off (default). Create another new project Y with publicity is on . While keeping user A logging on, in another browser log in as user B (non-admin). User B checks his/her public projects to see if project Y is listed and project X is not listed. User A changes project X's publicity to on, project Y's publicity to off. User B refreshes his/her public projects to see if project X is listed and project Y is not listed. On a Docker client host, use `docker login <harbor_host>` to log in as user A. User A runs `docker push` to push an image to project X, push an image to project Y. User A checks in the browser that the images had been successfully pushed to project X and Y. On a Docker client host, use `docker login <harbor_host>` to log in as user B. User B runs `docker pull` to an image of project X, and an image of project Y. Step 5, user B should see project Y is listed and project X is not listed. Step 7, user B should see project X is listed and project Y is not listed. Step 9,10, images should be pushed to project X and Y successfully and can be viewed from UI. Step 11,12, user B can pull the image of project X, cannot pull from project Y. None
Project: YugabyteDB (App Definition and Development / Database)
File: include-prerequisites-linux.md

<!-- +++ private = true +++ --> Before installing YugabyteDB, ensure that you have the following available: One of the . Python 3. To check the version, execute the following command: ```sh python --version ``` ```output Python 3.7.3 ``` By default, CentOS 8 does not have an unversioned system-wide `python` command. To fix this, set `python3` as the alternative for `python` by running `sudo alternatives --set python /usr/bin/python3`. Starting from Ubuntu 20.04, `python` is no longer available. To fix this, run `sudo apt install python-is-python3`. `wget` or `curl`. The instructions use the `wget` command to download files. If you prefer to use `curl`, you can replace `wget` with `curl -O`. To install `wget`: On CentOS, run `yum install wget` On Ubuntu, run `apt install wget` To install `curl`: On CentOS, run `yum install curl` On Ubuntu, run `apt install curl`
Project: Meshery (Provisioning / Automation & Configuration)
File: 10-05-2022-11-45-10_adc5b5b7.md

timestamp: "2022-10-05 11:45:20 UTC Wed" meshery-component: meshery-consul meshery-component-version: edge meshery-server-version: "v0.6.10" k8s-distro: minikube k8s-version: "v1.20.11" service-mesh: Consul service-mesh-version: "v0.49.0" tests: consul-client: null consul-server: null overall-status: "failing"
Project: ShardingSphere (App Definition and Development / Database)
File: parse-sql.en.md

+++ title = "PARSE SQL" weight = 1 +++ The `PARSE SQL` syntax is used to parse `SQL` and output abstract syntax tree. {{< tabs >}} {{% tab name="Grammar" %}} ```sql ParseSql ::= 'PARSE' sqlStatement ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} | Column | Description | |-|--| | parsed_statement | parsed SQL statement type | | parsedstatementdetail | detail of the parsed statement | Parse `SQL` and output abstract syntax tree ```sql PARSE SELECT * FROM t_order; ``` ```sql mysql> PARSE SELECT * FROM t_order; +-+-+ | parsedstatement | parsedstatement_detail | +-+-+ | MySQLSelectStatement | {"projections":{"startIndex":7,"stopIndex":7,"projections":[{"startIndex":7,"stopIndex":7}],"distinctRow":false},"from":{"tableName":{"startIndex":14,"stopIndex":20,"identifier":{"value":"t_order","quoteCharacter":"NONE"}}},"parameterCount":0,"parameterMarkerSegments":[],"commentSegments":[]} | +-+-+ 1 row in set (0.01 sec) ``` `PARSE`
Project: Meshery (Provisioning / Automation & Configuration)
File: wordpress-operator.md

layout: integration title: Wordpress Operator subtitle: Collaborative and visual infrastructure as code for Wordpress Operator image: /assets/img/integrations/wordpress-operator/icons/color/wordpress-operator-color.svg permalink: extensibility/integrations/wordpress-operator docURL: https://docs.meshery.io/extensibility/integrations/wordpress-operator description: integrations-category: Tools integrations-subcategory: Uncategorized registrant: Artifact Hub components: featureList: [ "Drag-n-drop cloud native infrastructure designer to configure, model, and deploy your workloads.", "Invite anyone to review and make changes to your private designs.", "Ongoing synchronization of Kubernetes configuration and changes across any number of clusters." ] howItWorks: "Collaborative Infrastructure as Code" howItWorksDetails: "Collaboratively manage infrastructure with your coworkers synchronously sharing the same designs." language: en list: include type: extensibility category: integrations