feat: Add Firebase plugin with Remote Config read support - #236
feat: Add Firebase plugin with Remote Config read support#236r-pedraza wants to merge 24 commits into
Conversation
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension. |
![wiz-c04d923138[bot]](https://avatars.githubusercontent.com/in/2278396?s=60&v=4){kind=small}
| if module_name is None: | ||
| raise AttributeError(f"module {__name__!r} has no attribute {name!r}") | ||
|
|
||
| value = getattr(import_module(module_name, __name__), name) |
There was a problem hiding this comment.
Arbitrary Code Execution via Insecure Import (CWE-706)
More Details
The importlib.import_module() function in Python allows dynamically importing modules at runtime. If the module name is derived from untrusted user input, an attacker could potentially execute arbitrary code on the system by causing a malicious module to be loaded.
| Attribute | Value |
|---|---|
| Impact |  |
| Likelihood |  |
Remediation
The importlib.import_module() function in Python allows for dynamic code loading, which can be a security risk if the module name is derived from untrusted user input. An attacker could potentially exploit this vulnerability to execute arbitrary code on the system, leading to various security issues such as code injection, data tampering, or unauthorized access.
To fix this issue, avoid using dynamic values in importlib.import_module() or implement a strict whitelist of allowed module names. If dynamic module loading is necessary, validate and sanitize the input to ensure that only trusted and approved modules are loaded.
Code examples
# VULNERABLE CODE - Directly using user input for module loading
import importlib
user_input = input("Enter module name: ")
module = importlib.import_module(user_input)# SECURE CODE - Using a whitelist of allowed modules
import importlib
ALLOWED_MODULES = ["module1", "module2", "module3"]
user_input = input("Enter module name: ")
if user_input in ALLOWED_MODULES:
module = importlib.import_module(user_input)
else:
print("Module not allowed")Additional recommendations
- Follow the principle of least privilege and only grant the minimum required permissions for module loading.
- Implement input validation and sanitization techniques to prevent code injection attacks.
- Consider using a secure coding framework or library that provides built-in protection against code injection vulnerabilities.
- Adhere to the OWASP Top 10 security guidelines, specifically "A1:2021 - Broken Access Control" and "A3:2021 - Injection."
- Regularly update and maintain the whitelist of allowed modules to ensure it remains secure and up-to-date.
Rule ID: WS-I013-PYTHON-00176
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
…ate normalization
1 participant
Pull Request
📝 Summary
Adds a new Firebase plugin to Titan that provides Google Cloud ADC authentication validation and Firebase Remote Config template reading capabilities. This is PR1 of the Firebase integration, establishing the foundation for future multi-brand Remote Config workflows.
🔧 Changes Made
titan-plugin-firebasepackage withFirebasePluginclassFirebaseClientwith ADC authentication methods (is_available,get_active_account,get_adc_access_token)firebase_loginstep for validating ADC sessionsfirebase_statusstep for reporting authentication statusfirebase_remoteconfig_getstep for reading Remote Config templates🧪 Testing
poetry run pytest)make test)titan-devUnit tests cover FirebaseClient authentication methods, Remote Config API interactions, and all three workflow steps with various input combinations and error scenarios.
📊 Logs
firebase_adc_available(DEBUG) — ADC availability check resultfirebase_remoteconfig_get_ok(DEBUG) — project_id, etag, durationfirebase_remoteconfig_get_failed(DEBUG) — project_id, error, duration✅ Checklist
Plugins > Git Plugin,GitHub Plugin,Jira Plugin)