I receive an error from the Station-WS during one of the tests of "testStation.py".
AssertionError: -1 not greater than or equal to 0

Publish a configuration file including all EIDA nodes.

In the cached version of the Station-WS I received the following error from the test in "testStation.py".
AssertionError: -1 not greater than or equal to 0

Probably getEIDAconfig.py should not read from an Arclink server, but from a Routing Server.

Cherrypy is skipping the process of the body if content-type is not passed. Mainly due to security reasons. I have to check that SC3 is passing it. In any case, it would be better to have a default value of text/plain.

In the cached version of the Station-WS I received the following error from the test in "testStation.py".
AssertionError: -1 not greater than or equal to 0

Instead of a 204 I receive a 400. The test was done with "testService.py".

I'm a Cyber Security researcher and developer of PackjGuard [1] to address open-source software supply chain attacks.

Issue

During my research, I detected a deleted package in this repository.

Details

Specifically, the package owndc mentioned in file README at line 39 does not exist on the public PyPI registry. A bad actor can hijack this package to propagate malicious code.

Impact

Not only your apps/services using https://github.com/javiquinte/owndc repo code are vulnerable to this attack, but the users of your open-source Github repo could also fall victim.

You could read more about such attacks here: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Remediation

Please highlight this in file README and register a placeholder package for owndc on public PyPI soon to remediate.

To automatically fix such issues in future, please install PackjGuard Github app [1].

Thanks!

1. PackjGuard is a Github app that monitors your repos 24x7, detects vulnerable/malicious/risky open-source dependencies, and creates pull requests for auto remediation: https://github.com/marketplace/packjguard

The cache of stations was important when the client is unknown and because a station could be passed without network. This is not the case, as SC3 is the client, who will always pass the station as a parameter.
In the worst case, it is owndc the one who receives the redundant routes, but those disappear due to the 204 HTTP error codes from the non-authoritative data centres.

In the test case where net=XX, the return code is not 204 as it should be.

Some work has been done to cache the StationXML data from Station-WS and deliver them locally. However, a better approach would be to start with the text mode of Station-WS, which can be easily implemented copy-pasting the dataselect approach.

The set of routes to load is too large and this does not make sense. Leave only a minimal set of routes to be able to run the tests.

Now we have a version of some files of the Routing Service commited in the repository. Should we have a submodule so that we don't mantain the updates in the other systems?

Large URIs should return a 414 instead of a 400. Check only in the GET method.