Spaces:
Running
Running
Commit History
-
🛡️ Patching and Rebuilding the Document Processor APIIntroductionWelcome to the secure software supply chain automation notebook! As a Senior DevOps Engineer, our goal here is to take the vulnerable code base for the Document Processor API and fully remediate its critical dependencies before triggering a new, secure container build using Google Cloud Build.We have identified and patched high-severity vulnerabilities in h11, transformers, and setuptools. This notebook consolidates those fixes into an automated process.Step 1: Setup and Clone RepositoryWe first clone the original vulnerable project repository. The existing structure (like the app/ directory) is needed to complete the build process.# Clone the repository containing the original application code
Verified signature!git clone [https://github.com/olwordeaux/document-processor.git](https://github.com/olwordeaux/document-processor.git) # Change into the project directory %cd document-processor Step 2: Create Patched pyproject.tomlThe original pyproject.toml contained insecure dependency versions. We will replace it entirely with a new version that explicitly pins the patched versions for known vulnerabilities:h11 (^0.16.0): Fixes a Critical HTTP Request Smuggling vulnerability (CVE-2025-43859).transformers (^4.53.0): Fixes multiple High-Severity ReDoS (Regular Expression Denial of Service) issues.setuptools (^78.1.1): Fixes a High-Severity Path Traversal vulnerability (CVE-2025-47273).# Use a HEREDOC to create the patched pyproject.toml file cat <<EOF > pyproject.toml [tool.poetry] name = "document-processor-api" version = "0.1.0" description = "FastAPI service for PDF content extraction." authors = ["Senior Software Engineer <se@example.com>"] readme = "README.md" packages = [{include = "app"}] […1979bf2 -
initial commit
Verified signaturea33cc5f