### Install documentation dependencies Source: https://github.com/brightway-lca/brightway2-data/blob/main/docs/content/contributing.md Installs the package with both development and documentation extras. ```console $ pip install -e ".[dev,docs]" ``` -------------------------------- ### Install testing dependencies Source: https://github.com/brightway-lca/brightway2-data/blob/main/docs/content/contributing.md Installs the package with testing requirements. ```console $ pip install -e ".[testing]" ``` -------------------------------- ### Install bw2data via pip Source: https://github.com/brightway-lca/brightway2-data/blob/main/README.md Use this command to install the package from PyPI. ```console $ pip install bw2data ``` -------------------------------- ### Install development dependencies Source: https://github.com/brightway-lca/brightway2-data/blob/main/docs/content/contributing.md Installs the package in editable mode with development requirements. ```console $ pip install -e ".[dev]" ``` -------------------------------- ### Install pre-commit hooks Source: https://github.com/brightway-lca/brightway2-data/blob/main/docs/content/contributing.md Installs pre-commit for linting and formatting checks using either conda/mamba or pip. ```console # conda or mamba $ conda install pre-commit ``` ```default $ pip install pre-commit ``` -------------------------------- ### Basic XSS Attempts Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These examples demonstrate fundamental XSS payloads using standard HTML and JavaScript tags. They are useful for initial vulnerability scanning. ```html ``` ```html <script>alert('123');</script> ``` ```html ``` ```html ``` ```html "> ``` ```html '> ``` ```html > ``` ```html ``` ```html < / script >< script >alert(123)< / script > ``` ```html --> ``` ```html ";alert(123);t=" ';alert(123);t=' ``` -------------------------------- ### Command Injection in Ruby Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These examples demonstrate strings that can be used for command injection within Ruby/Rails applications. They leverage methods that execute system commands. ```ruby eval("puts 'hello world'") ``` ```ruby System("ls -al /") ``` ```ruby `ls -al /` ``` ```ruby Kernel.exec("ls -al /") ``` ```ruby Kernel.exit(1) ``` ```ruby %x('ls -al /') ``` -------------------------------- ### Server Code Injection Examples Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These strings can lead to arbitrary code execution on the server, potentially with privileged user rights. They are often used in contexts where input is evaluated as code. ```shell /dev/null; touch /tmp/blns.fail ; echo ``` ```shell `touch /tmp/blns.fail` ``` ```shell $(touch /tmp/blns.fail) ``` ```ruby @{[system "touch /tmp/blns.fail"]} ``` -------------------------------- ### Scunthorpe Problem Examples Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These are innocuous strings that may be mistakenly blocked by profanity filters due to containing substrings that resemble offensive words. This highlights the challenges in content moderation. ```text Scunthorpe General Hospital ``` ```text Penistone Community Church ``` ```text Lightwater Country Park ``` ```text Jimmy Clitheroe ``` ```text Horniman Museum ``` ```text shitake mushrooms ``` ```text RomansInSussex.co.uk ``` ```text http://www.cum.qc.ca/ ``` ```text Craig Cockburn, Software Specialist ``` ```text Linda Callahan ``` ```text Dr. Herman I. Libshitz ``` ```text magna cum laude ``` ```text Super Bowl XXX ``` ```text medieval erection of parapets ``` ```text evaluate ``` ```text mocha ``` ```text expression ``` ```text Arsenal canal ``` ```text classic ``` ```text Tyson Gay ``` ```text basement ``` -------------------------------- ### JavaScript URI Scheme Variations Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These examples test the handling of JavaScript URIs within attributes like 'href' and 'src', including case variations and obfuscation. ```html onfocus=JaVaSCript:alert(123) autofocus ``` ```html " onfocus=JaVaSCript:alert(123) autofocus ``` ```html ' onfocus=JaVaSCript:alert(123) autofocus ``` ```html JavaSCript:alert(123) ``` ```html src=JaVaSCript:prompt(132) ``` -------------------------------- ### File Inclusion Examples Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These strings are designed to exploit file inclusion vulnerabilities in web servers, allowing attackers to include unintended files, potentially leading to information disclosure or code execution. ```url ../../..\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd%00 ``` ```url ../../..\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/hosts ``` -------------------------------- ### SQL Injection Examples Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These strings can be used to exploit SQL injection vulnerabilities if user input is not properly sanitized. They aim to manipulate SQL queries to reveal or modify data. ```sql 1;DROP TABLE users ``` ```sql 1'; DROP TABLE users-- ``` ```sql ' OR 1=1 -- ``` ```sql ' OR '1'='1 ``` ```sql % ``` ```sql _ ``` -------------------------------- ### Human Injection Example Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt This string is designed to cause a human reader to reinterpret their reality, often used in fictional contexts or as a psychological trick. ```text If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. ``` -------------------------------- ### Unwanted Interpolation Examples Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These strings can be unintentionally expanded or evaluated in certain contexts like printf format strings or eval functions, potentially exposing sensitive data or causing incorrect behavior. ```text $HOME ``` ```text $ENV{'HOME'} ``` ```text %d ``` ```text %s ``` ```text {0} ``` ```text %*.*s ``` -------------------------------- ### Obfuscated JavaScript URIs in Links Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These examples test the execution of JavaScript URIs within anchor tags, using various non-standard whitespace characters and encodings to bypass filters. ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` ```html test ``` -------------------------------- ### CSS Expression XSS Payloads Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt These examples leverage the 'expression()' function within CSS properties to execute JavaScript. This technique is effective against older browsers or improperly configured sanitizers. ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` ```html ABC
DEF ``` -------------------------------- ### Build documentation locally Source: https://github.com/brightway-lca/brightway2-data/blob/main/README.md Commands to set up the documentation environment and build the HTML output. ```bash conda env create -f docs/environment.yml ``` ```bash conda activate sphinx_bw2data ``` ```bash sphinx-build docs _build/html --builder=html --jobs=auto --write-all; open _build/html/index.html ``` -------------------------------- ### Build documentation locally Source: https://github.com/brightway-lca/brightway2-data/blob/main/docs/content/contributing.md Uses sphinx-build to generate documentation from the docs directory. ```console # use docs as source and docs/_build as output sphinx-build docs docs/_build ``` -------------------------------- ### Retrieve activity by integer ID Source: https://github.com/brightway-lca/brightway2-data/blob/main/CHANGES.md Demonstrates retrieving an activity using its integer ID via get_activity or Database.get. ```python >>> bw2data.get_activity(19014) 'treatment of aluminium in car shredder residue, municipal incineration' (kilogram, RoW, None) >>> bw2data.Database("something").get(19014) 'treatment of aluminium in car shredder residue, municipal incineration' (kilogram, RoW, None) ``` -------------------------------- ### Import necessary libraries Source: https://github.com/brightway-lca/brightway2-data/blob/main/dev/Speed tests DataFrame creation.ipynb Imports the wurst, bw2data, and pandas libraries required for data extraction and manipulation. ```python import wurst import bw2data as bd import pandas as pd ``` -------------------------------- ### Retrieve activity ID from key Source: https://github.com/brightway-lca/brightway2-data/blob/main/CHANGES.md Demonstrates how to resolve an activity or its key to an integer ID. ```python >>> bw2data.get_id(a) 19014 >>> bw2data.get_id(a.key) 19014 ``` -------------------------------- ### Run test suite Source: https://github.com/brightway-lca/brightway2-data/blob/main/docs/content/contributing.md Executes the project's unit tests using the pytest framework. ```console $ pytest ``` -------------------------------- ### Create and compare DataFrame memory usage Source: https://github.com/brightway-lca/brightway2-data/blob/main/dev/Speed tests DataFrame creation.ipynb Creates two DataFrames using `as_naive_df`: one with categorical data and one without. It then compares their memory usage in megabytes to quantify the benefits of using categorical types. ```python df_compressed = as_naive_df(data) df_full = as_naive_df(data, False) ``` ```python df_compressed.memory_usage().sum() / 1024 ** 2, df_full.memory_usage().sum() / 1024 ** 2 ``` -------------------------------- ### Define Ecoinvent Cache Path Source: https://github.com/brightway-lca/brightway2-data/blob/main/dev/Export-biosphere.ipynb Sets the path to the Ecoinvent cache directory. Asserts that the directory exists before proceeding. ```python from pathlib import Path dp = Path("/Users/chrismutel/Library/Application Support/EcoinventInterface/cache/ecoinvent 3.6_consequential_ecoSpold02/MasterData") assert dp.is_dir() ``` -------------------------------- ### Set current Brightway2 project Source: https://github.com/brightway-lca/brightway2-data/blob/main/dev/Speed tests DataFrame creation.ipynb Sets the active project in Brightway2 to 'ei 3.8 cutoff'. This is a prerequisite for accessing specific database versions. ```python bd.projects.set_current("ei 3.8 cutoff") ``` -------------------------------- ### Script Tag with URL Parameters Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by including URL parameters within a script source URL, which might be processed in unexpected ways. ```html ``` ```html ``` -------------------------------- ### Display DataFrame data types Source: https://github.com/brightway-lca/brightway2-data/blob/main/dev/Speed tests DataFrame creation.ipynb Prints the data types of the columns in the `df_compressed` DataFrame, which was created with categorical columns. This allows verification of the applied data type conversions. ```python df_compressed.dtypes ``` -------------------------------- ### Script Tag with Obfuscated Source Path Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by using format string specifiers in script source paths, which might be interpreted by certain server-side or client-side parsers. ```html ``` ```html ``` -------------------------------- ### JavaScript String Termination and Comment Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by using a string termination character followed by an alert and a comment, aiming to break out of existing script contexts. ```javascript ";alert('XSS');// ``` -------------------------------- ### HTML Image Tag with Script Injection Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by injecting a script tag directly after an image tag, using double quotes and angle brackets for obfuscation. ```html "> ``` -------------------------------- ### HTML Anchor and Image Tags with Backtick Injection Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by using backticks within an anchor tag's href and an image tag's alt attribute to inject script. ```html `><script>javascript:alert(1)</script>> ``` -------------------------------- ### HTML Script Tag with Nested Tags Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by using nested script tags and comments to confuse parsers. ```html < ``` -------------------------------- ### XXE Injection (XML) Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt This XML string can be used to exploit XXE vulnerabilities in improperly configured XML parsers, potentially revealing system files like '/etc/passwd'. ```xml ]>&xxe; ``` -------------------------------- ### HTML Span Tag with Copy Event Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by triggering a JavaScript alert via the 'oncopy' event on a span tag. ```html Copy me ``` -------------------------------- ### HTML Image Tag with Malformed Attributes Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by using malformed attribute syntax and comments within an image tag to inject script. ```html ``` -------------------------------- ### HTML Iframe Tag with Incomplete Tag Source: https://github.com/brightway-lca/brightway2-data/blob/main/tests/fixtures/naughty_strings.txt Tests XSS by using an incomplete iframe tag, which might lead to parsing errors that expose vulnerabilities. ```html