Merge branch 'master' into fix/security-fix-9

Author: daniel-rdt

doc/release_notes.md

@@ -31,21 +31,27 @@
 
 **Bugfixes and Compatibility**
 
+* Rename bus for `t339` project (Tyrrhenian) from ITSI to ITVI ([#751](https://github.com/open-energy-transition/open-tyndp/pull/751)).
+
 **Documentation**
 
 * Update benchmarking documentation tables and figures for v0.7.1 ([#711](https://github.com/open-energy-transition/open-tyndp/pull/711)).
 
-* Migrate the Sphinx/RST-based documentation to MkDocs/Markdown, as a follow-up to the [upstream migration](https://github.com/PyPSA/pypsa-eur/pull/2162) ([754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
+* Migrate the Sphinx/RST-based documentation to MkDocs/Markdown, as a follow-up to the [upstream migration](https://github.com/PyPSA/pypsa-eur/pull/2162) ([#754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
 
 **Developers Note**
 
 * Change GitHub issue templates to comply with ISO security checks ([#714](https://github.com/open-energy-transition/open-tyndp/pull/714), [#730](https://github.com/open-energy-transition/open-tyndp/pull/730)).
 
-* Introduce SBOM/Grype vulnerability scanning workflow, as a follow-up to the [upstream addition](https://github.com/PyPSA/pypsa-eur/pull/2164) ([754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
+* Introduce SBOM/Grype vulnerability scanning workflow, as a follow-up to the [upstream addition](https://github.com/PyPSA/pypsa-eur/pull/2164) ([#754](https://github.com/open-energy-transition/open-tyndp/pull/754)).
+
+* Ensure `inflow_t` is always defined in `attach_hydro`, resolving a pylint use-before-assignment issue ([#777](https://github.com/open-energy-transition/open-tyndp/pull/777)).
+
+* Add missing regex anchors with `re.fullmatch` to `create_zenodo_deposition_cli` utils script ([#778](https://github.com/open-energy-transition/open-tyndp/pull/778)).
 
-* Ensure `inflow_t` is always defined in `attach_hydro`, resolving a pylint use-before-assignment issue ([777](https://github.com/open-energy-transition/open-tyndp/pull/777)).
+* Add validation of Zenodo deposition ID in `create_zenodo_deposition_cli` to close URL-manipulation finding ([#780](https://github.com/open-energy-transition/open-tyndp/pull/780)).
 
-* Add missing regex anchors with `re.fullmatch` to `create_zenodo_deposition_cli` utils script ([778](https://github.com/open-energy-transition/open-tyndp/pull/778)).
+* Prevent `create_zenodo_deposition_cli` from leaking secrets in logs under `--debug` by scoping debug logging to the local logger instead of the root logger ([#781](https://github.com/open-energy-transition/open-tyndp/pull/781)).
 
 * Add sanitization of CLI inputs passed to `launch_explorer` ([#776](https://github.com/open-energy-transition/open-tyndp/pull/776)).
 

scripts/cba/clean_projects.py

@@ -131,6 +131,18 @@ def extract_transmission_projects(
         .str.extract(r"(?P<bus0>[A-Za-z0-9]{4,}) ?- ?(?P<bus1>[A-Za-z0-9]{4,})$")
     )
 
+    # For project t339, the border is given as ITCS-ITSI and ITSA-ITSI, when it should be connected to the virtual node ITVI instead: ITCS-ITVI and ITSA-ITVI
+    # Manually fixing this here (changing the border and bus1 columns)
+    t339_mask = projects.loc[projects["project_id"] == 339].index
+    projects.loc[t339_mask, ["border", "bus1"]] = projects.loc[
+        t339_mask, ["border", "bus1"]
+    ].replace(
+        {
+            "border": {"ITCS-ITSI": "ITCS-ITVI", "ITSA-ITSI": "ITSA-ITVI"},
+            "bus1": {"ITSI": "ITVI"},
+        }
+    )
+
     unclear_border = ~(
         projects["bus0"].isin(existing_buses) & projects["bus1"].isin(existing_buses)
     )

utils/create_zenodo_deposition_cli.py

@@ -310,6 +310,13 @@ def publish_zenodo_deposition(deposition_id: int) -> requests.Response:
     Response
         The response from the Zenodo API after publishing the deposition.
     """
+    # Validate id to be positive integer (rejecting bool, int-like strings and traversals)
+    if (
+        isinstance(deposition_id, bool)
+        or not isinstance(deposition_id, int)
+        or deposition_id <= 0
+    ):
+        raise ValueError(f"Invalid Zenodo deposition ID: {deposition_id!r}")
     r = requests.post(
         f"{ZENODO_API_URL}/deposit/depositions/{deposition_id}/actions/publish",
         params={"access_token": ZENODO_API_KEY},
@@ -451,6 +458,9 @@ def main(
     """
     Guide the user through creating a new Zenodo deposition or version.
     """
+    # Set the global logging level
+    logging.basicConfig(level=logging.INFO)
+
     global ZENODO_API_URL
     ZENODO_API_URL = API_URLS["sandbox"] if sandbox else API_URLS["production"]
 
@@ -462,7 +472,8 @@ def main(
             fg=typer.colors.YELLOW,
         )
     if debug:
-        logging.basicConfig(level=logging.DEBUG)
+        # change local logger level to debug
+        logger.setLevel(logging.DEBUG)
         typer.secho("Debug mode enabled.", fg=typer.colors.YELLOW)
 
     typer.secho("=" * 80, fg=typer.colors.CYAN)