Add benchmark dashboard

[PranjalC100]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces a web-based benchmark dashboard for GCSFuse, adding a FastAPI backend, a frontend SPA, and integrating it with the existing distributed micro-benchmark orchestrator. Key security and code quality feedback highlights high-severity vulnerabilities, including path traversal in file previews, stored XSS in frontend rendering, and SQL injection in BigQuery queries. Additionally, improvements are suggested to handle subprocess termination on task cancellation, utilize the native GCS client library instead of blocking shell commands, and fix a hardcoded project ID in the BigQuery history endpoint.

[gemini-code-assist]

The current path validation uses startswith on the resolved path string. This is vulnerable to path traversal if there are sibling directories with similar prefixes (e.g., /home/user/gcs and /home/user/gcs_other). Using pathlib.Path.relative_to is a much more robust and secure way to ensure the path is strictly inside the target directory.

Suggested change

	safe_path = (DMB_DIR / path).resolve()
	if not str(safe_path).startswith(str(DMB_DIR)):
	raise HTTPException(status_code=403, detail="Access denied: Path lies outside benchmark directory")
	try:
	safe_path = (DMB_DIR / path).resolve()
	safe_path.relative_to(DMB_DIR.resolve())
	except ValueError:
	raise HTTPException(status_code=403, detail="Access denied: Path lies outside benchmark directory")

[gemini-code-assist]

User-controlled fields like run.description and run.username are rendered directly into the DOM using innerHTML without escaping. This introduces a Stored Cross-Site Scripting (XSS) vulnerability. All user-supplied values should be escaped before being rendered in HTML.

        const escapeHtml = (str) => {
            if (!str) return '';
            return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;');
        };
        item.innerHTML = `
            <div class="flex justify-between items-start mb-2">
                <span class="font-mono text-xs text-slate-500 font-bold">${escapeHtml(run.benchmark_id)}</span>
                <span class="text-[10px] font-bold px-2 py-0.5 rounded border uppercase tracking-wider ${statusColors[run.status] || 'bg-slate-100'}">${escapeHtml(run.status)}</span>
            </div>
            <h4 class="font-bold text-sm text-slate-800 mb-1 truncate">${escapeHtml(run.description)}</h4>
            <p class="text-xs text-slate-500 mb-2">VM: <span class="font-mono font-bold text-slate-700">${escapeHtml(run.executor_vm)}</span></p>
            <div class="flex justify-between items-center text-[10px] text-slate-400">
                <span>User: ${escapeHtml(run.username)}</span>
                <button onclick="cancelRun(event, '${escapeHtml(run.benchmark_id)}')" class="text-red-600 hover:text-red-800 font-bold uppercase transition"><i class="fa-solid fa-ban mr-1"></i>Cancel</button>
            </div>
        `;

[gemini-code-assist]

If the execute_orchestrator task is cancelled (e.g., during shutdown or manual cancellation), the await process.wait() call will raise asyncio.CancelledError. However, the spawned subprocess will continue running in the background as an orphaned process. Wrapping the subprocess wait in a try...except asyncio.CancelledError block ensures that the subprocess is properly terminated when the task is cancelled.

    process = None
    try:
        # Open local log file to stream subprocess output
        with open(log_file_path, "w") as log_f:
            process = await asyncio.create_subprocess_exec(
                "python3", *args,
                cwd=str(DMB_DIR),
                stdout=log_f,
                stderr=subprocess.STDOUT if hasattr(subprocess, 'STDOUT') else log_f
            )
            
            # Wait for execution to finish
            exit_code = await process.wait()
            
            if exit_code == 0:
                logger.info(f"Subprocess finished successfully for {benchmark_id}")
                db.update_run_status(benchmark_id, "completed", completed_at=datetime.utcnow().isoformat())
            else:
                logger.error(f"Subprocess failed with exit code {exit_code} for {benchmark_id}")
                db.update_run_status(benchmark_id, "failed", completed_at=datetime.utcnow().isoformat())
    except asyncio.CancelledError:
        if process and process.returncode is None:
            logger.warning(f"Orchestrator process for {benchmark_id} was cancelled. Terminating subprocess...")
            try:
                process.terminate()
                await process.wait()
            except Exception as e:
                logger.error(f"Failed to terminate subprocess: {e}")
        raise

[gemini-code-assist]

The proj variable is retrieved from run_config (which contains user-supplied values stored in the SQLite database) and is directly interpolated into the BigQuery SQL query string. This introduces a SQL injection vulnerability. Validating the project ID against a strict regular expression before query execution is highly recommended.

Suggested change

	# Resolve GCE project dynamically from DB, fallback to default
	run_config = db.get_run(rid)
	proj = run_config.get("project", project_id) if run_config else project_id
	import re
	run_config = db.get_run(rid)
	proj = run_config.get("project", project_id) if run_config else project_id
	if not re.match(r"^[a-z0-9\-]{6,30}$", proj):
	raise HTTPException(status_code=400, detail="Invalid project ID format")

[gemini-code-assist]

Spawning a synchronous gcloud storage cp subprocess to write a cancellation flag to GCS is inefficient and blocks the threadpool. Since the google-cloud-storage library is already imported and used in this file, you should use the native GCS client library instead.

Suggested change

	if run["status"] == "running":
	# Create cancel flag in GCS for workers to detect
	try:
	import subprocess
	cancel_path = f"gs://{run['artifacts_bucket']}/{run_id}/cancel"
	subprocess.run(['gcloud', 'storage', 'cp', '-', cancel_path], input=b'cancelled', check=True)
	logger.info(f"GCS cancellation flag written for {run_id}")
	except Exception as e:
	logger.error(f"Failed to create cancel flag in GCS: {e}")
	if run["status"] == "running":
	# Create cancel flag in GCS for workers to detect
	try:
	client = storage.Client()
	bucket = client.bucket(run['artifacts_bucket'])
	blob = bucket.blob(f"{run_id}/cancel")
	blob.upload_from_string("cancelled")
	logger.info(f"GCS cancellation flag written for {run_id}")
	except Exception as e:
	logger.error(f"Failed to create cancel flag in GCS: {e}")

[gemini-code-assist]

The get_bq_history endpoint accepts a project_id parameter but hardcodes gcs-fuse-test-ml in the SQL query, rendering the parameter useless. The query should safely interpolate the validated project_id parameter.

Suggested change

	query = """
	SELECT DISTINCT benchmark_id, run_timestamp, commit, mount_args, io_type
	FROM `gcs-fuse-test-ml.periodic_benchmarks.kokoro_run_*`
	UNION DISTINCT
	SELECT DISTINCT benchmark_id, run_timestamp, commit, mount_args, io_type
	FROM `gcs-fuse-test-ml.adhoc_benchmarks.local_run_*`
	ORDER BY run_timestamp DESC
	LIMIT 100
	"""
	import re
	if not re.match(r"^[a-z0-9\-]{6,30}$", project_id):
	raise HTTPException(status_code=400, detail="Invalid project ID format")
	query = f"""
	SELECT DISTINCT benchmark_id, run_timestamp, commit, mount_args, io_type
	FROM `{project_id}.periodic_benchmarks.kokoro_run_*`
	UNION DISTINCT
	SELECT DISTINCT benchmark_id, run_timestamp, commit, mount_args, io_type
	FROM `{project_id}.adhoc_benchmarks.local_run_*`
	ORDER BY run_timestamp DESC
	LIMIT 100
	"""