Merge branch 'main' into noWriteModeV2

Author: sbyrne-sf

.github/workflows/sf_cli_integration.yml

@@ -17,6 +17,18 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Set mock server TLS cert paths
+      run: |
+        echo "MOCK_SF_CERT_FILE=$RUNNER_TEMP/mock_sf_cert.pem" >> "$GITHUB_ENV"
+        echo "MOCK_SF_KEY_FILE=$RUNNER_TEMP/mock_sf_key.pem" >> "$GITHUB_ENV"
+
+    - name: Generate mock server TLS cert
+      run: |
+        openssl req -x509 -newkey rsa:2048 -nodes \
+          -keyout "$MOCK_SF_KEY_FILE" -out "$MOCK_SF_CERT_FILE" \
+          -days 1 -subj "/CN=localhost" \
+          -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
+
     - name: Set up Python 3.11
       uses: actions/setup-python@v5
       with:
@@ -73,7 +85,7 @@ jobs:
         sfdx_dir.mkdir(exist_ok=True)
         auth = {
             "accessToken": "00D000000000001AAA!fakeTokenForCITesting",
-            "instanceUrl": "http://localhost:8888",
+            "instanceUrl": "https://localhost:8888",
             "loginUrl": "https://login.salesforce.com",
             "orgId": "00D000000000001AAA",
             "userId": "005000000000001AAA",
@@ -164,6 +176,9 @@ jobs:
       # ── Script: run ───────────────────────────────────────────────────────────
 
     - name: '[script] run — sf data-code-extension script run --entrypoint testScript/payload/entrypoint.py -o dev1'
+      env:
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension script run \
           --entrypoint testScript/payload/entrypoint.py \
@@ -175,6 +190,9 @@ jobs:
       # ── Script: deploy ───────────────────────────────────────────────────────
 
     - name: '[script] deploy — sf data-code-extension script deploy'
+      env:
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension script deploy \
           --name test-script-deploy \
@@ -262,6 +280,9 @@ jobs:
       # ── Function: run ─────────────────────────────────────────────────────────
 
     - name: '[function] run — sf data-code-extension function run --entrypoint testFunction/payload/entrypoint.py  --test-with testFunction/payload/tests/test.json -o dev1'
+      env:
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension function run \
           --entrypoint testFunction/payload/entrypoint.py \
@@ -273,6 +294,9 @@ jobs:
       # ── Function: deploy ─────────────────────────────────────────────────────
 
     - name: '[function] deploy — sf data-code-extension function deploy'
+      env:
+        NODE_EXTRA_CA_CERTS: ${{ env.MOCK_SF_CERT_FILE }}
+        REQUESTS_CA_BUNDLE: ${{ env.MOCK_SF_CERT_FILE }}
       run: |
         sf data-code-extension function deploy \
           --name test-function-deploy \

README.md

@@ -509,7 +509,7 @@ exploration.  Instead of running an entire script, one can run one code cell at
 
 You can read more about Jupyter Notebooks here: https://jupyter.org/
 
-1. Within the root project of your package folder, run `./jupyterlab.sh start`
+1. Within the root project of your package folder, run `./jupyterlab.sh start`. This prints an access token and opens an already-authenticated JupyterLab session in your browser. If the browser doesn't open automatically, copy the printed `http://localhost:8888/?token=...` URL into your browser.
 1. Double-click on "account.ipynb" file, which provides a starting point for a notebook
 1. Use shift+enter to execute each cell within the notebook.  Add/edit/delete cells of code as needed for your data exploration.
 1. Don't forget to run `./jupyterlab.sh stop` to stop the docker container
@@ -600,4 +600,4 @@ If you're using OAuth Tokens authentication, the initial configure will retrieve
 ## Other docs
 
 - [Troubleshooting](./docs/troubleshooting.md)
-- [For Contributors](./FOR_CONTRIBUTORS.md)
+- [Contributing](./CONTRIBUTING.md)

scripts/mock_sf_server.py

@@ -40,13 +40,25 @@
     python scripts/mock_sf_server.py          # listens on port 8888
     MOCK_SF_PORT=9000 python scripts/mock_sf_server.py
     python scripts/mock_sf_server.py 9000
+
+Serves TLS (the deploy path requires an HTTPS upload URL) using a pre-generated
+cert/key pair — this script does not generate one. Set ``MOCK_SF_CERT_FILE`` /
+``MOCK_SF_KEY_FILE`` to the pair's paths; generate a throwaway one with:
+
+    openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem \\
+      -days 1 -subj "/CN=localhost" \\
+      -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
+
+Point clients at the cert so they trust it: ``NODE_EXTRA_CA_CERTS`` (CLI) and
+``REQUESTS_CA_BUNDLE`` (SDK).
 """
 
 from __future__ import annotations
 
 from http.server import BaseHTTPRequestHandler, HTTPServer
 import json
 import os
+import ssl
 import sys
 
 PORT = (
@@ -68,7 +80,7 @@
 
 _TOKEN_RESPONSE = {
     "access_token": "00D000000000001AAA!fakeAccessTokenForCITesting",
-    "instance_url": f"http://localhost:{PORT}",
+    "instance_url": f"https://localhost:{PORT}",
     "token_type": "Bearer",
     "scope": "api",
 }
@@ -135,7 +147,9 @@ def do_POST(self) -> None:
         elif path == _DATA_CUSTOM_CODE_PATH:
             # create_deployment() — return a presigned upload URL
             self._send_json(
-                {"fileUploadUrl": f"http://localhost:{PORT}/upload/fake-deployment.zip"}
+                {
+                    "fileUploadUrl": f"https://localhost:{PORT}/upload/fake-deployment.zip"
+                }
             )
         elif path == _DATA_TRANSFORMS_PATH:
             # create_data_transform() — script packages only
@@ -150,7 +164,18 @@ def do_PUT(self) -> None:
 
 
 if __name__ == "__main__":
+    cert_path = os.environ.get("MOCK_SF_CERT_FILE")
+    key_path = os.environ.get("MOCK_SF_KEY_FILE")
+    if not cert_path or not key_path:
+        sys.exit(
+            "MOCK_SF_CERT_FILE and MOCK_SF_KEY_FILE must both be set to an "
+            "existing TLS cert/key pair — see the module docstring."
+        )
+
     server = HTTPServer(("localhost", PORT), MockSFHandler)
     server.allow_reuse_address = True
-    print(f"[MOCK SF] Listening on http://localhost:{PORT}", flush=True)
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.load_cert_chain(cert_path, key_path)
+    server.socket = ctx.wrap_socket(server.socket, server_side=True)
+    print(f"[MOCK SF] Listening on https://localhost:{PORT}", flush=True)
     server.serve_forever()

src/datacustomcode/templates/script/jupyterlab.sh

@@ -45,26 +45,39 @@ check_docker() {
     echo "Docker daemon is running"
 }
 
+# Function to check if openssl is installed
+check_openssl() {
+    if ! command -v openssl &> /dev/null; then
+        echo "openssl is not installed. It is required to generate a secure JupyterLab access token."
+        exit 1
+    fi
+}
+
 # Function to start Jupyter server
 start_jupyter() {
     echo "Building the docker image"
     docker build -t datacloud-customcode .
 
+    local TOKEN
+    TOKEN=$(openssl rand -hex 32)
+
     echo "Running the docker container"
-    docker run -d --rm -p 8888:8888 \
+    docker run -d --rm -p 127.0.0.1:8888:8888 \
         -v $(pwd):/workspace \
         --name jupyter-server \
         datacloud-customcode jupyter lab \
         --ip=0.0.0.0 \
         --port=8888 \
         --no-browser \
         --allow-root \
-        --NotebookApp.token='' \
-        --NotebookApp.password='' \
+        --NotebookApp.token="$TOKEN" \
         --notebook-dir=/workspace
 
     sleep 3  # Wait for server to start
-    open_browser "http://localhost:8888"
+    local URL
+    URL="http://localhost:8888/?token=$TOKEN"
+    echo "Opening $URL"
+    open_browser $URL
 }
 
 # Function to stop Jupyter server
@@ -82,6 +95,7 @@ stop_jupyter() {
 case "$1" in
     "start")
         check_docker
+        check_openssl
         start_jupyter
         ;;
     "stop")

tests/test_jupyterlab_script.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import os
+import subprocess
+
+from datacustomcode.template import script_template_dir
+
+JUPYTERLAB_SH = os.path.join(script_template_dir, "jupyterlab.sh")
+
+# These tests don't actually run the jupyter script. They simply verify
+# certain specific configurations of the script for things like syntax
+# and security correctness.
+#
+# These were added when fixing a bug that could have allowed for RCE
+# over the local network on the user's device due to previous insufficient
+# network config. While not perfect, they do offer a bit of assurance that
+# the script is configured correctly.
+
+
+class TestJupyterlabScript:
+    def _read(self) -> str:
+        with open(JUPYTERLAB_SH) as f:
+            return f.read()
+
+    def test_jupyterlab_sh_syntax_is_valid(self):
+        """`bash -n` should accept the script without syntax errors."""
+        result = subprocess.run(
+            ["bash", "-n", JUPYTERLAB_SH],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        assert result.returncode == 0, result.stderr
+
+    def test_start_jupyter_binds_loopback_host_port(self):
+        content = self._read()
+        assert "-p 127.0.0.1:8888:8888" in content
+        assert "-p 8888:8888" not in content
+
+    def test_start_jupyter_binds_container_to_all_interfaces(self):
+        content = self._read()
+        assert "--ip=0.0.0.0" in content
+        assert "--ip=127.0.0.1" not in content
+
+    def test_start_jupyter_generates_token_not_empty_auth(self):
+        content = self._read()
+        assert "--NotebookApp.token=''" not in content
+        assert "--NotebookApp.password=''" not in content
+        assert "openssl rand -hex 32" in content
+
+    def test_start_jupyter_uses_dynamic_token_variable(self):
+        content = self._read()
+        assert "local TOKEN" in content
+        assert "TOKEN=$(openssl rand -hex 32)" in content
+        assert '--NotebookApp.token="$TOKEN"' in content
+
+    def test_open_browser_url_includes_token_param(self):
+        content = self._read()
+        assert 'URL="http://localhost:8888/?token=$TOKEN"' in content
+        assert "open_browser $URL" in content
+
+    def test_token_never_written_to_file(self):
+        content = self._read()
+        assert "credentials.ini" not in content
+        for line in content.splitlines():
+            if "TOKEN" in line:
+                assert ">" not in line, f"Line writes TOKEN to a file: {line!r}"