Commits on Oct 20, 2023

1. Add strict param to enforce RECAP_URLS for gateway …

   The gateway has a gaping security hole. It allows users to ls/schema on
   arbitrary URLs using whatever credentials the gateway host might have. This is
   dangerous in a cloud environment where the host might be given a service account
   with access to systems that end users should not have access to. It also is
   dangerous now that we have a FilesystemClient that allows users to read the
   local disk.
   
   I've fixed this by forcing the gateway to run `ls` and `schema` commands with
   `struct=True`. This parmater forces any URLs to be defined in the RECAP_URLS
   environment variable. Unknown URLs will now fail with a ValueError.
   
   I have left the CLI with `strict=False` because the users running locally should
   be able to query whatever they want using the credentials they have on their
   machine.

   

   criccomini committed Oct 20, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 8704e1d
   • Browse repository at this point

   Copy the full SHA

   8704e1d View commit details

   Browse the repository at this point in the history