Repository: freedomofpress/securedrop

Issue:
update ansible to 2.6.18 or later due to CVE-2019-10156
## Description

We should update Ansible to version 2.6.18 or later due to [CVE-2019-10156](https://nvd.nist.gov/vuln/detail/CVE-2019-10156). This is a templating vulnerability that would require an attacker to first insert malicious templates into the Admin workstation so the impact is minimal for SecureDrop. Nevertheless, to reduce alert noise and not be using dependencies with known vulnerabilities, we should update. 


Discussion:

Resolving patch:
diff --git a/install_files/ansible-base/callback_plugins/ansible_version_check.py b/install_files/ansible-base/callback_plugins/ansible_version_check.py
--- a/install_files/ansible-base/callback_plugins/ansible_version_check.py
+++ b/install_files/ansible-base/callback_plugins/ansible_version_check.py
@@ -21,7 +21,7 @@ class CallbackModule(CallbackBase):
     def __init__(self):
         # Can't use `on_X` because this isn't forwards compatible
         # with Ansible 2.0+
-        required_version = '2.6.14'  # Keep synchronized with requirements files
+        required_version = '2.6.19'  # Keep synchronized with requirements files
         if not ansible.__version__.startswith(required_version):
             print_red_bold(
                 "SecureDrop restriction: only Ansible {version}.*"


Test patch:
diff --git a/docs/development/testing_configuration_tests.rst b/docs/development/testing_configuration_tests.rst
--- a/docs/development/testing_configuration_tests.rst
+++ b/docs/development/testing_configuration_tests.rst
@@ -14,7 +14,7 @@ Installation
 
 .. code:: sh
 
-    pip install -r securedrop/requirements/develop-requirements.txt
+    pip install --require-hashes -r securedrop/requirements/python3/develop-requirements.txt
 
 
 Running the Config Tests
diff --git a/molecule/testinfra/staging/app/test_tor_config.py b/molecule/testinfra/staging/app/test_tor_config.py
--- a/molecule/testinfra/staging/app/test_tor_config.py
+++ b/molecule/testinfra/staging/app/test_tor_config.py
@@ -8,13 +8,13 @@
 @pytest.mark.parametrize('package', [
     'tor',
 ])
-def test_tor_packages(Package, package):
+def test_tor_packages(host, package):
     """
     Ensure Tor packages are installed. Does not include the Tor keyring
     package, since we want only the SecureDrop Release Signing Key
     to be used even for Tor packages.
     """
-    assert Package(package).is_installed
+    assert host.package(package).is_installed
 
 
 def test_tor_service_running(host):
diff --git a/molecule/testinfra/staging/common/test_grsecurity.py b/molecule/testinfra/staging/common/test_grsecurity.py
--- a/molecule/testinfra/staging/common/test_grsecurity.py
+++ b/molecule/testinfra/staging/common/test_grsecurity.py
@@ -52,7 +52,7 @@ def test_generic_kernels_absent(host, package):
     c = host.run("dpkg -l {}".format(package))
     assert c.rc == 1
     error_text = "dpkg-query: no packages found matching {}".format(package)
-    assert c.stderr == error_text
+    assert error_text in c.stderr.strip()
 
 
 def test_grsecurity_lock_file(host):
@@ -71,8 +71,8 @@ def test_grsecurity_kernel_is_running(host):
     Make sure the currently running kernel is specific grsec kernel.
     """
     c = host.run('uname -r')
-    assert c.stdout.endswith('-grsec')
-    assert c.stdout == '{}-grsec'.format(KERNEL_VERSION)
+    assert c.stdout.strip().endswith('-grsec')
+    assert c.stdout.strip() == '{}-grsec'.format(KERNEL_VERSION)
 
 
 @pytest.mark.parametrize('sysctl_opt', [
@@ -130,7 +130,7 @@ def test_grub_pc_marked_manual(host):
     """
     c = host.run('apt-mark showmanual grub-pc')
     assert c.rc == 0
-    assert c.stdout == "grub-pc"
+    assert c.stdout.strip() == "grub-pc"
 
 
 def test_apt_autoremove(host):
diff --git a/molecule/testinfra/staging/common/test_tor_mirror.py b/molecule/testinfra/staging/common/test_tor_mirror.py
--- a/molecule/testinfra/staging/common/test_tor_mirror.py
+++ b/molecule/testinfra/staging/common/test_tor_mirror.py
@@ -28,7 +28,7 @@ def test_tor_keyring_absent(host):
     c = host.run("dpkg -l {}".format(package))
     assert c.rc == 1
     error_text = "dpkg-query: no packages found matching {}".format(package)
-    assert c.stderr.rstrip() == error_text
+    assert error_text in c.stderr.strip()
 
 
 @pytest.mark.parametrize('tor_key_info', [
diff --git a/molecule/testinfra/staging/common/test_user_config.py b/molecule/testinfra/staging/common/test_user_config.py
--- a/molecule/testinfra/staging/common/test_user_config.py
+++ b/molecule/testinfra/staging/common/test_user_config.py
@@ -65,7 +65,7 @@ def test_sudoers_tmux_env(host):
             (tmux attach || tmux_attach_via_proc || tmux new-session)
         fi"""
     )
-    assert host_file.content_string == expected_content
+    assert host_file.content_string.strip() == expected_content
 
 
 def test_tmux_installed(host):