-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(misconf): support symlinks inside of Helm archives #6621
Conversation
c840605
to
9841b99
Compare
case tar.TypeSymlink: | ||
if path.IsAbs(link) { | ||
p.debug.Log("Symlink %s is absolute, skipping", link) | ||
continue |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In your test case, can we add a symlink that can exercise this path? An assertion for that could be the absence of the absolute symlink so that we know it's not included.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Such a file would be missing anyway, since it is not in the virtual file system.
b, err := io.ReadAll(src) | ||
if err != nil { | ||
return fmt.Errorf("read error: %w", err) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should we add a buffered reader incase we encounter huge files again?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The file write method accepts bytes, so we still have to read the whole file.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
break | ||
} | ||
return nil, fmt.Errorf("failed to copy: %w", err) | ||
func copySymlink(fsys *memoryfs.FS, src, dst string) error { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we take into account recursive symlinks?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's already being handled. Added a test case e0bc1eb
file, err := os.Open(testPath) | ||
defer func() { _ = file.Close() }() | ||
require.NoError(t, err) | ||
|
||
assert.Equal(t, test.isHelmChart, detection.IsHelmChartArchive(test.archiveFile, file)) | ||
func() { | ||
file, err := os.Open(testPath) | ||
require.NoError(t, err) | ||
defer file.Close() | ||
|
||
_ = file.Close() | ||
assert.Equal(t, test.isHelmChart, detection.IsHelmChartArchive(test.archiveFile, file)) | ||
}() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How about this to make them table driven? We could do it for the rest of the tests in this file since we are here.
diff --git a/pkg/iac/scanners/helm/test/parser_test.go b/pkg/iac/scanners/helm/test/parser_test.go
index 989590d42..68cc050e4 100644
--- a/pkg/iac/scanners/helm/test/parser_test.go
+++ b/pkg/iac/scanners/helm/test/parser_test.go
@@ -111,16 +111,16 @@ func Test_tar_is_chart(t *testing.T) {
}
for _, test := range tests {
+ t.Run(test.testName, func(t *testing.T) {
+ t.Logf("Running test: %s", test.testName)
+ testPath := filepath.Join("testdata", test.archiveFile)
- t.Logf("Running test: %s", test.testName)
- testPath := filepath.Join("testdata", test.archiveFile)
- func() {
file, err := os.Open(testPath)
require.NoError(t, err)
defer file.Close()
assert.Equal(t, test.isHelmChart, detection.IsHelmChartArchive(test.archiveFile, file))
- }()
+ })
}
}
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done 5155dbd
Description
Since symbolic links are not supported in the virtual file system, the files referenced are copied to FS.
Related issues
Checklist