Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Security Factory failed when multiple specs is used in same configuration #46

Closed
42atomys opened this issue Mar 12, 2022 · 0 comments
Assignees
Labels
(╯°□°)╯︵ ┻━┻ 🤯 Aaargh! aspect/backend 💻 Concerns the backend code in the repository domain/complicated 🟨 The relationship between cause and effect requires analysis or expertise priority/critical 🟥 Priority 1 - Must be fixed ASAP type/bug 🔥 Something isn't working
Milestone

Comments

@42atomys
Copy link
Owner

Describe the bug
When multiple specs is provided, all security pipelines of previous definition is overrided by the last.

To Reproduce
Steps to reproduce the behavior:

  1. My config is
apiVersion: v1alpha1
observability:
  metricsEnabled: true
specs:
- name: exampleHook
  entrypointUrl: /webhooks/example
  security:
  - header:
      inputs:
      - name: headerName
        value: X-Hook-Secret
  - compare:
      inputs:
      - name: first
        value: '{{ .Outputs.header.value }}'
      - name: second
        valueFrom:
          envRef: HOOK_SECRET
  storage:
  - type: redis
    specs:
      host: localhost
      port: '6379'
      database: 0
      key: foo
- name: gitlab
  entrypointUrl: /webhooks/gitlab
  security:
  - header:
      inputs:
      - name: headerName
        value: X-Gitlab-Token
  - compare:
      inputs:
      - name: first
        value: '{{ .Outputs.header.value }}'
      - name: second
        valueFrom:
          envRef: GITLAB_WEBHOOK_TOKEN
  storage:
  - type: redis
    specs:
      host: localhost
      port: '6379'
      database: 0
      key: gitlab
  1. Try to store following payload
env DEBUG=true GITLAB_WEBHOOK_TOKEN=houk2 curl --request POST \
  --url http://localhost:8080/v1alpha1/webhooks/example \
  --header 'Content-Type: application/json' \
  --header 'X-Gitlab-Token: houk2' \
  --data '{
	"type": 42,
	"payload": {
		"nested": "amazing"
	}
}'
  1. See error

Expected behavior
The security line need to return 401 due to missing X-Hook-Secret header in her spec definition.

Backtrace error / Logs

7:12PM DBG running factory header
7:12PM DBG factory header input request = &{Method:POST URL:/v1alpha1/webhooks/example Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[Accept:[*/*] Content-Length:[55] Content-Type:[application/json] User-Agent:[insomnia/2022.1.0] X-Gitlab-Token:[houk2]] Body:0xc0001c1ec0 GetBody:<nil> ContentLength:55 TransferEncoding:[] Close:false Host:localhost:8080 Form:map[] PostForm:map[] MultipartForm:<nil> Trailer:map[] RemoteAddr:[::1]:53382 RequestURI:/v1alpha1/webhooks/example TLS:<nil> Cancel:<nil> Response:<nil> ctx:0xc00033c960}
7:12PM DBG factory header input headerName = &{Valuable:{Value:0xc0002509c0 Values:[] ValueFrom:<nil>} Name:headerName}
7:12PM DBG factory header output value = houk2
7:12PM DBG running factory compare
7:12PM DBG factory compare input first = &{Valuable:{Value:0xc000250b50 Values:[] ValueFrom:<nil>} Name:first}
7:12PM DBG factory compare input second = &{Valuable:{Value:<nil> Values:[] ValueFrom:0xc000250c60} Name:second}
7:12PM WRN [houk2] + [] = false
7:12PM DBG factory compare output result = false
7:12PM DBG security factory passed: false
7:12PM DBG Webhook processed apiVersion=v1alpha1 entry=exampleHook
7:12PM INF Webhook is processed duration="361.9µs" secure=true spec=exampleHook statusCode=403 version=v1alpha1
@42atomys 42atomys added priority/critical 🟥 Priority 1 - Must be fixed ASAP type/bug 🔥 Something isn't working domain/complicated 🟨 The relationship between cause and effect requires analysis or expertise labels Mar 12, 2022
@42atomys 42atomys added this to the 1.0 milestone Mar 12, 2022
@42atomys 42atomys self-assigned this Mar 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
(╯°□°)╯︵ ┻━┻ 🤯 Aaargh! aspect/backend 💻 Concerns the backend code in the repository domain/complicated 🟨 The relationship between cause and effect requires analysis or expertise priority/critical 🟥 Priority 1 - Must be fixed ASAP type/bug 🔥 Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant