Repository: ckan/ckan

Issue:
[Snyk] Security upgrade urllib3 from 1.25.8 to 1.25.9
<h3>Snyk has created this PR to fix one or more vulnerable packages in the `pip` dependencies of this project.</h3>



#### Changes included in this PR

- Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    - requirements.txt



#### Vulnerabilities that will be fixed





##### By pinning:
Severity                   | Priority Score (*)                   | Issue                   | Upgrade                   | Breaking Change                   | Exploit Maturity
:-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------|:-------------------------
![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity")  |  **671/1000**  <br/> **Why?** Recently disclosed, Has a fix available, CVSS 7.7  | HTTP Header Injection <br/>[SNYK-PYTHON-URLLIB3-1014645](https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-1014645) |  `urllib3:` <br> `1.25.8 -> 1.25.9` <br>  |  No  | No Known Exploit 

(*) Note that the real score may have changed since the PR was raised.




Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the effected dependencies could be upgraded.


Check the changes in this PR to ensure they won't cause issues with your project.



------------



**Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.*

For more information:  <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiIzYmUwODlhMy1iNTQ0LTRiMTktOTViNi05NGY5NTFiYmUzYzAiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjNiZTA4OWEzLWI1NDQtNGIxOS05NWI2LTk0Zjk1MWJiZTNjMCJ9fQ==" width="0" height="0"/>
🧐 [View latest project report](https://app.snyk.io/org/wardi/project/7696de9f-5904-4fe5-8767-91ee8e4d2b04)

🛠 [Adjust project settings](https://app.snyk.io/org/wardi/project/7696de9f-5904-4fe5-8767-91ee8e4d2b04/settings)

📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)

[//]: # (snyk:metadata:{"prId":"3be089a3-b544-4b19-95b6-94f951bbe3c0","dependencies":[{"name":"urllib3","from":"1.25.8","to":"1.25.9"}],"packageManager":"pip","projectPublicId":"7696de9f-5904-4fe5-8767-91ee8e4d2b04","projectUrl":"https://app.snyk.io/org/wardi/project/7696de9f-5904-4fe5-8767-91ee8e4d2b04?utm_source=github&utm_medium=fix-pr","type":"auto","patch":[],"vulns":["SNYK-PYTHON-URLLIB3-1014645"],"upgrade":[],"isBreakingChange":false,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[671]})



Discussion:
@pdelboca as `urllib3` is a `requests` requirement, let see if we can upgrade requests instead to a version that will bump urllib3.

The way we normally handle requirements update is:


1. Update the version on `requirements.in`
2. Run `pip-compile requirements.in -o requirements.txt` (you need to `pip install pip-tools` first)
3. Repeat the same process for `requirements.py2.in` and `requirements-py2.txt` (we'll get rid of these soon, but best to keep things consistent)

If the requests upgrade does not upgrade the urrlib3 version we'll update the `.txt` files directly but I don't think it will be necessary.

Resolving patch:
diff --git a/ckan/lib/helpers.py b/ckan/lib/helpers.py
--- a/ckan/lib/helpers.py
+++ b/ckan/lib/helpers.py
@@ -18,12 +18,11 @@
 import functools
 
 from collections import defaultdict
-from paste.deploy import converters
 
 import dominate.tags as dom_tags
 from markdown import markdown
 from bleach import clean as bleach_clean, ALLOWED_TAGS, ALLOWED_ATTRIBUTES
-from ckan.common import config, is_flask_request
+from ckan.common import asbool, config, is_flask_request
 from flask import redirect as _flask_redirect
 from flask import _request_ctx_stack
 from flask import url_for as _flask_default_url_for
@@ -2892,7 +2891,7 @@ def clean_html(html):
 core_helper(i18n.get_locales_dict)
 core_helper(literal)
 # Useful additions from the paste library.
-core_helper(converters.asbool)
+core_helper(asbool)
 # Useful additions from the stdlib.
 core_helper(urlencode)
 core_helper(include_asset)


Test patch:
diff --git a/ckan/tests/model/test_user.py b/ckan/tests/model/test_user.py
--- a/ckan/tests/model/test_user.py
+++ b/ckan/tests/model/test_user.py
@@ -82,9 +82,9 @@ def test_upgrade_from_sha_with_wrong_password_fails_to_upgrade(self):
     def test_upgrade_from_pbkdf2_with_less_rounds(self):
         """set up a pbkdf key with less than the default rounds
 
-    If the number of default_rounds is increased in a later version of
-    passlib, ckan should upgrade the password hashes for people without
-    involvement from users"""
+        If the number of default_rounds is increased in a later version of
+        passlib, ckan should upgrade the password hashes for people without
+        involvement from users"""
         user = factories.User()
         password = u"testpassword"
         user_obj = model.User.by_name(user["name"])