Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrict loading to root or below. #700

Merged
merged 1 commit into from
Jan 16, 2019

Conversation

monopole
Copy link
Contributor

@monopole monopole commented Jan 15, 2019

Kustomization files refer to two kinds of files outside the kustomization file itself:

  • bases (other kustomizations)
    These can be git URLs, or paths specified relative to the root (as long as they don't go strictly "up").

  • data paths for the current kustomization
    Things like resources, patches, data for configmaps, etc.
    These must be paths specified relative to the root

where root is the directory containing the kustomization file specifying these things.

This PR imposes an additional requirement on data paths.

They must still be root relative paths, but additionally they cannot go up out of root, either explicitly, or by following symbolic links. They can only refer to files in or below root.

This will require an increment in semver major, since it disallows certain file loading patterns.

No existing examples or documentation need to change, since this file arrangement wasn't used.

Example of disallowed behavior and how to fix:

Supposed a single data file foo/common/data.txt is referenced in two similar configmap generator rules in two different directories foo/overlay1 and foo/overlay2. This is now disallowed, because the data is outside the two respective kustomization roots.

The fix is to simply add a kustomization file to the directory containing the data, and refer to that as a base from the kustomizations in the two overlays (i.e. refer to the base, not the data). It remains OK to go up and over when referring to a base (though not directly up, since that can result in cycles).

A followup PR should include an example discussing/defining this.

Fixes #693

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: monopole

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 15, 2019
@monopole monopole requested review from Liujingfang1 and removed request for droot and mengqiy January 15, 2019 01:31
Copy link
Contributor

@Liujingfang1 Liujingfang1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me. Just one comment on the error messages.

func (l *fileLoader) Load(path string) ([]byte, error) {
if filepath.IsAbs(path) {
return nil, fmt.Errorf(
"must use relative path; '%s' is absolute", path)
return nil, l.loadOutOfBounds(path)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The previous error message looks better. We can leave it unchanged.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Message updated.

This is now a change from

must use relative path; '/etc/tls.key' is absolute.

to

"security; file `/etc/tls.key` is not in or below `/the/kustomization/root`,

How's that?

Copy link

@DirectXMan12 DirectXMan12 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fileLoader godoc needs to be updated with the new info.

This technically also disallows symlinks between "root trees" where the load might otherwise be acceptable (AFAICT), but that may be an acceptable caveat.

if l.Root() == string(filepath.Separator) {
return true
}
return strings.HasPrefix(
Copy link

@DirectXMan12 DirectXMan12 Jan 15, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this needs a warning so that people don't strip off the trailing slash (which would make it more incorrect that in currently is). This is technically still wrong (https://codereview.appspot.com/5712045, golang/dep#296, golang/go#18358 (comment)) due to filesystem case sensitivity, etc. The fully correct answer appears to be https://github.com/mem/dep/blob/c409fbd7e3dc2df0422061f4a5a28fd6555a78ba/internal/fs.go#L44, but it's tricky. If you decide to stick with this, note the caveats (since this is even less correct than filepath.HasPrefix on Windows).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks much for those links.

I've updated this comment and the overall class doc.

@DirectXMan12
Copy link

new comments look good
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 16, 2019
@k8s-ci-robot k8s-ci-robot merged commit 549290c into kubernetes-sigs:master Jan 16, 2019
@monopole monopole deleted the restrictLoading branch January 22, 2019 17:57
mszostok added a commit to kyma-project/test-infra that referenced this pull request Feb 13, 2019
* Provide first controller implemenation

* Finialize slack reporter implementation

* Fixing deploy resources

* Fix rbac

* Add test coverage for controller

* Change the golang builder image version

* Change the way who mock are generated

* kustomization.yaml was moved outside the /default folder, see kubernetes-sigs/kustomize#700

* Change Gopkg.lock to work with dep 0.5.x

* Add fetching commit author

* Add more info in README.md

* Apply changes after Adam review

* Add milv ignore
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

File paths may not step up.
4 participants