sciabarracom opened a new pull request, #121:
URL: https://github.com/apache/openserverless-operator/pull/121
Follow-up to #109, which validated spec.namespace but left two other tenant
controlled WhiskUser fields flowing unsanitized into shell commands executed
inside the data pods via kubectl exec.
* spec.postgres.database reached `bash -c "... psql --dbname {db_name}"` in
exec_psql_command_in_db. Unlike the namespace field it never becomes a
filename, so it was not even constrained to path safe characters.
* spec.object-storage.{data,route}.bucket reached `sh -c "echo '{command}' |
weed shell"` in the seaweedfs client, where a quote breaks out of the single
quoted string.
Adds util.validate_database_name and util.validate_bucket_name next to the
existing validate_namespace and applies them at the call sites and at the shell
sinks, plus matching CEL rules on the CRD so the API server rejects the payload
before the operator sees it. The regexes and the CEL rules were cross checked
to accept exactly the same inputs.
Also:
* guards the latent render_kvrocks_script / exec_kvrocks_command pair, which
repeats the same pattern but is not currently wired into the user path
* makes validate_namespace return False for non string input instead of
raising TypeError
* corrects a copy pasted error message referring to exec_mongosh_command
inside exec_psql_command
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
