From 7b4e588537e47dc0622d8b5c883d8f16c5fa9712 Mon Sep 17 00:00:00 2001 From: Derek Mitchell Date: Thu, 30 Jul 2026 15:40:35 -0700 Subject: [PATCH] updated tagging workshop to resolve SSRF issue --- .../3-deploy-sample-app.md | 4 ++-- .../tagging/3-capture-tags/2-capture-tags-python.md | 8 ++++---- workshop/tagging/.gitignore | 1 + workshop/tagging/creditcheckservice-py-with-tags/main.py | 6 +++--- workshop/tagging/creditcheckservice-py/main.py | 6 +++--- workshop/tagging/creditprocessorservice/main.py | 2 +- 6 files changed, 14 insertions(+), 13 deletions(-) create mode 100644 workshop/tagging/.gitignore diff --git a/content/en/ninja-workshops/foundations/4-solving-problems-with-o11y-cloud/3-deploy-sample-app.md b/content/en/ninja-workshops/foundations/4-solving-problems-with-o11y-cloud/3-deploy-sample-app.md index 8ebac292a1..68af5bcae1 100644 --- a/content/en/ninja-workshops/foundations/4-solving-problems-with-o11y-cloud/3-deploy-sample-app.md +++ b/content/en/ninja-workshops/foundations/4-solving-problems-with-o11y-cloud/3-deploy-sample-app.md @@ -203,7 +203,7 @@ def credit_check(): current_span.set_attribute("customer.num", customerNum) # <--- ADDED BY WORKSHOP # Get Credit Score - creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore?customernum=" + customerNum) + creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore", params={"customernum": customerNum}) creditScoreReq.raise_for_status() creditScore = int(creditScoreReq.text) current_span.set_attribute("credit.score", creditScore) # <--- ADDED BY WORKSHOP @@ -212,7 +212,7 @@ def credit_check(): current_span.set_attribute("credit.score.category", creditScoreCategory) # <--- ADDED BY WORKSHOP # Run Credit Check - creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck?customernum=" + str(customerNum) + "&score=" + str(creditScore)) + creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck", params={"customernum": customerNum, "score": creditScore}) creditCheckReq.raise_for_status() checkResult = str(creditCheckReq.text) current_span.set_attribute("credit.check.result", checkResult) # <--- ADDED BY WORKSHOP diff --git a/content/en/scenarios/debug-problems/tagging/3-capture-tags/2-capture-tags-python.md b/content/en/scenarios/debug-problems/tagging/3-capture-tags/2-capture-tags-python.md index 0e35af48a8..895bfb6e15 100644 --- a/content/en/scenarios/debug-problems/tagging/3-capture-tags/2-capture-tags-python.md +++ b/content/en/scenarios/debug-problems/tagging/3-capture-tags/2-capture-tags-python.md @@ -16,14 +16,14 @@ def credit_check(): customerNum = request.args.get('customernum') # Get Credit Score - creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore?customernum=" + customerNum) + creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore", params={"customernum": customerNum}) creditScoreReq.raise_for_status() creditScore = int(creditScoreReq.text) creditScoreCategory = getCreditCategoryFromScore(creditScore) # Run Credit Check - creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck?customernum=" + str(customerNum) + "&score=" + str(creditScore)) + creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck", params={"customernum": customerNum, "score": creditScore}) creditCheckReq.raise_for_status() checkResult = str(creditCheckReq.text) @@ -67,7 +67,7 @@ def credit_check(): current_span.set_attribute("customer.num", customerNum) # <--- ADDED BY WORKSHOP # Get Credit Score - creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore?customernum=" + customerNum) + creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore", params={"customernum": customerNum}) creditScoreReq.raise_for_status() creditScore = int(creditScoreReq.text) current_span.set_attribute("credit.score", creditScore) # <--- ADDED BY WORKSHOP @@ -76,7 +76,7 @@ def credit_check(): current_span.set_attribute("credit.score.category", creditScoreCategory) # <--- ADDED BY WORKSHOP # Run Credit Check - creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck?customernum=" + str(customerNum) + "&score=" + str(creditScore)) + creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck", params={"customernum": customerNum, "score": creditScore}) creditCheckReq.raise_for_status() checkResult = str(creditCheckReq.text) current_span.set_attribute("credit.check.result", checkResult) # <--- ADDED BY WORKSHOP diff --git a/workshop/tagging/.gitignore b/workshop/tagging/.gitignore new file mode 100644 index 0000000000..ba0430d26c --- /dev/null +++ b/workshop/tagging/.gitignore @@ -0,0 +1 @@ +__pycache__/ \ No newline at end of file diff --git a/workshop/tagging/creditcheckservice-py-with-tags/main.py b/workshop/tagging/creditcheckservice-py-with-tags/main.py index 4f2aef8919..28b5f88387 100644 --- a/workshop/tagging/creditcheckservice-py-with-tags/main.py +++ b/workshop/tagging/creditcheckservice-py-with-tags/main.py @@ -20,7 +20,7 @@ def credit_check(): current_span.set_attribute("customer.num", customerNum) # <--- ADDED BY WORKSHOP # Get Credit Score - creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore?customernum=" + customerNum) + creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore", params={"customernum": customerNum}) creditScoreReq.raise_for_status() creditScore = int(creditScoreReq.text) current_span.set_attribute("credit.score", creditScore) # <--- ADDED BY WORKSHOP @@ -29,7 +29,7 @@ def credit_check(): current_span.set_attribute("credit.score.category", creditScoreCategory) # <--- ADDED BY WORKSHOP # Run Credit Check - creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck?customernum=" + str(customerNum) + "&score=" + str(creditScore)) + creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck", params={"customernum": customerNum, "score": creditScore}) creditCheckReq.raise_for_status() checkResult = str(creditCheckReq.text) current_span.set_attribute("credit.check.result", checkResult) # <--- ADDED BY WORKSHOP @@ -56,4 +56,4 @@ def getCreditCategoryFromScore(score): return creditScoreCategory if __name__ == '__main__': - serve(app, port=8888) \ No newline at end of file + serve(app, port=8888) diff --git a/workshop/tagging/creditcheckservice-py/main.py b/workshop/tagging/creditcheckservice-py/main.py index 401c6cb7d5..3c027de1d2 100644 --- a/workshop/tagging/creditcheckservice-py/main.py +++ b/workshop/tagging/creditcheckservice-py/main.py @@ -17,14 +17,14 @@ def credit_check(): customerNum = request.args.get('customernum') # Get Credit Score - creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore?customernum=" + customerNum) + creditScoreReq = requests.get("http://creditprocessorservice:8899/getScore", params={"customernum": customerNum}) creditScoreReq.raise_for_status() creditScore = int(creditScoreReq.text) creditScoreCategory = getCreditCategoryFromScore(creditScore) # Run Credit Check - creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck?customernum=" + str(customerNum) + "&score=" + str(creditScore)) + creditCheckReq = requests.get("http://creditprocessorservice:8899/runCreditCheck", params={"customernum": customerNum, "score": creditScore}) creditCheckReq.raise_for_status() checkResult = str(creditCheckReq.text) @@ -50,4 +50,4 @@ def getCreditCategoryFromScore(score): return creditScoreCategory if __name__ == '__main__': - serve(app, port=8888) \ No newline at end of file + serve(app, port=8888) diff --git a/workshop/tagging/creditprocessorservice/main.py b/workshop/tagging/creditprocessorservice/main.py index 3cefc7e9bb..6ea289b89b 100644 --- a/workshop/tagging/creditprocessorservice/main.py +++ b/workshop/tagging/creditprocessorservice/main.py @@ -50,7 +50,7 @@ def run_credit_check(): time.sleep(5) if iScore < 300: - requests.get("http://otherservice:777/extra?customernum=" + customernum) + requests.get("http://otherservice:777/extra", params={"customernum": customernum}) return "OK"