mirror of
https://github.com/galaxyproject/galaxy.git
synced 2026-09-24 16:30:27 +08:00
mvdbeekandNicola Soranzo
6b07f5492f
Updates the pinned FastAPI/Starlette versions on release_25.1 to match
upstream/dev, closing CVE-2026-48710 ("BadHost"). The vulnerability lets
an attacker inject a path into the HTTP Host header and have
``request.url.path`` reflect that path, bypassing path-based access
control in middleware. Starlette 1.0.1+ rejects Host headers with
invalid characters; we pin starlette==1.1.0 to match dev.
Drops Python 3.9 support, matching upstream/dev (commit eb9fde1dcd).
Starlette dropped 3.9 in 0.50.0, so the BadHost fix (starlette >= 1.0.1)
cannot be installed on 3.9. Bumping the floor to 3.10 is the only way
to ship the security fix; the alternative -- marker-splitting the pins
to keep 3.9 on starlette 0.49.x -- would leave 3.9 users exposed to the
CVE we are trying to close.
Actual exposure on release_25.1 (pre-fix)
-----------------------------------------
Galaxy was running a vulnerable starlette but is **not exploitable for
the headline auth-bypass scenario**. Auth runs through FastAPI
dependencies (``get_user``, ``get_trans``, ``AdminUserRequired``), not
through path-string checks in middleware. ``AccessLoggingMiddleware``
already uses ``scope["path"]``; ``add_galaxy_middleware`` /
``GalaxyCORSMiddleware`` / ``RawContextMiddleware`` /
``SentryAsgiMiddleware`` do not branch on ``request.url.path``.
Lower-severity findings that this upgrade also closes:
- ``lib/galaxy/webapps/base/api.py`` ``get_error_response_for_request``
picks an error schema with ``"ga4gh"/"drs"/"trs" in
request.url.path`` -- spoofable Host nudges error payload shape
(info-disclosure / shape confusion only).
- ``lib/galaxy/webapps/galaxy/api/drs.py`` and
``lib/galaxy/webapps/galaxy/services/datasets.py`` derive DRS
``service_info`` / ``self_uri`` from ``request.url`` -- spoofable
Host poisons the advertised DRS identity and client-visible URIs,
not access.
- ``lib/tool_shed/webapp/api2/tools.py`` -- same shape, TRS service
info.
Bumping the pin closes the parser flaw at source and downgrades all of
the above to non-issues, so no separate ``request.url.path ->
scope["path"]`` sweep is needed.
Pin bumps (cherry-picks the relevant ranges from PRs #21526, #22206,
#22754):
- fastapi 0.118.0 -> 0.136.3
- starlette 0.48.0 -> 1.1.0
- starlette-context 0.4.0 -> 0.5.1
- python-multipart 0.0.20 -> 0.0.29
- anyio 4.11.0 -> 4.13.0
Required code changes backported from upstream/dev:
- ``lib/galaxy/webapps/openapi/_compat/v2.py``: import
``GenerateJsonSchema`` and ``get_flat_models_from_fields`` from
``fastapi._compat.v2`` and adopt the new ``get_definitions()``
implementation for FastAPI 0.128.8+ (PRs #21384, dev commits
0800c025ce, c8ccc7f44d, b3bfb45884).
- ``lib/galaxy/webapps/openapi/utils.py``: route ``GenerateJsonSchema``
through ``_compat.v2`` and drop the now-unreachable
``get_compat_model_name_map`` fallback (dev commit b3bfb45884).
- ``lib/galaxy/schema/generics.py``: drop ``CustomJsonSchema`` here
(moved to fast_app.py so it can use the patched ``GenerateJsonSchema``
from ``_compat.v2``).
- ``lib/galaxy/webapps/galaxy/fast_app.py``: relocate
``CustomJsonSchema`` and switch its base to the ``_compat.v2``
``GenerateJsonSchema``; replace the @app.middleware("http") X-Frame
Options handler with a pure ASGI ``XFrameOptionsMiddleware`` class
(dev commit 67eea395ab) since ``BaseHTTPMiddleware`` semantics
changed in starlette 1.0.
- ``lib/galaxy/webapps/base/api.py`` and
``lib/galaxy/webapps/galaxy/api/datasets.py``: drop the ``method``
argument of ``FileResponse`` which starlette 1.0 removed (dev commit
63954cb42e).
Also bumps the minimum FastAPI requirement to ``>=0.133.0`` (first
version compatible with starlette>=1.0.0) and adds an explicit
``starlette>=1.0.1`` floor in ``pyproject.toml`` and the
``packages/web_apps`` / ``packages/tool_shed`` setup.cfg files so
source installs cannot resolve to a vulnerable combo.
Co-authored-by: Nicola Soranzo <nicola.soranzo@gmail.com>
62 lines
2.0 KiB
ReStructuredText
62 lines
2.0 KiB
ReStructuredText
.. figure:: https://galaxyproject.org/images/galaxy-logos/galaxy_project_logo.jpg
|
|
:alt: Galaxy Logo
|
|
|
|
The latest information about Galaxy can be found on the `Galaxy Community Hub <https://galaxyproject.org/>`__.
|
|
|
|
Community support is available at `Galaxy Help <https://help.galaxyproject.org/>`__.
|
|
|
|
.. image:: https://img.shields.io/badge/chat-gitter-blue.svg
|
|
:target: https://gitter.im/galaxyproject/Lobby
|
|
:alt: Chat on gitter
|
|
|
|
.. image:: https://img.shields.io/badge/chat-irc.freenode.net%23galaxyproject-blue.svg
|
|
:target: https://webchat.freenode.net/?channels=galaxyproject
|
|
:alt: Chat on irc
|
|
|
|
.. image:: https://img.shields.io/badge/release-documentation-blue.svg
|
|
:target: https://docs.galaxyproject.org/en/master/
|
|
:alt: Release Documentation
|
|
|
|
.. image:: https://travis-ci.org/galaxyproject/galaxy.svg?branch=dev
|
|
:target: https://travis-ci.org/galaxyproject/galaxy
|
|
:alt: Inspect the test results
|
|
|
|
Galaxy Quickstart
|
|
=================
|
|
|
|
Galaxy requires Python 3.10 or higher. To check your Python version, run:
|
|
|
|
.. code:: console
|
|
|
|
$ python -V
|
|
Python 3.10.12
|
|
|
|
Start Galaxy:
|
|
|
|
.. code:: console
|
|
|
|
$ sh run.sh
|
|
|
|
Once Galaxy completes startup, you should be able to view Galaxy in your
|
|
browser at: http://localhost:8080
|
|
|
|
For more installation details please see: https://getgalaxy.org/
|
|
|
|
Documentation is available at: https://docs.galaxyproject.org/
|
|
|
|
Tutorials on how to use Galaxy, perform scientific analyses with it, develop Galaxy and its tools, and admin a Galaxy server are at: https://training.galaxyproject.org/
|
|
|
|
Tools
|
|
=====
|
|
|
|
Tools can be either installed from the Tool Shed or added manually.
|
|
For details please see the `tutorial <https://galaxyproject.org/admin/tools/add-tool-from-toolshed-tutorial/>`__.
|
|
Note that not all dependencies for the tools provided in the
|
|
``tool_conf.xml.sample`` are included. To install them please visit
|
|
"Manage dependencies" in the admin interface.
|
|
|
|
Issues and Galaxy Development
|
|
=============================
|
|
|
|
Please see `CONTRIBUTING.md <CONTRIBUTING.md>`_ .
|