Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of Fix CLI panic caused by single backslash values into release/1.8.x #14737

Merged
merged 4 commits into from
Mar 28, 2022

Conversation

hc-github-team-secure-vault-core
Copy link
Collaborator

Backport

This PR is auto-generated from #14523 to be assessed for backporting due to the inclusion of the label backport/1.8.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

The below text is copied from the body of the original PR.


Passing key=value fields whose value is a single backslash to the CLI will cause a panic. The underlying cause exists in go-secure-stdlib/kv-builder. A fix has been introduced in go-secure-stdlib/kv-builder PR #35.

This PR introduces the following changes:

  • Upgrade go-secure-stdlib/kv-builder to v0.1.2
  • Add a KV test to ensure that single backslash values do not panic

Before change:

❯ vault kv put secret/foo 'bar=\'
panic: runtime error: index out of range [1] with length 1

goroutine 1 [running]:
github.com/hashicorp/go-secure-stdlib/kv-builder.(*Builder).add(0xc0008cb440, {0x7ffeefbff898, 0x11880ee8})
        /Users/ccapurso/go/pkg/mod/github.com/hashicorp/go-secure-stdlib/kv-builder@v0.1.1/builder.go:94 +0x832
github.com/hashicorp/go-secure-stdlib/kv-builder.(*Builder).Add(0x7ffeefbff88d, {0xc0001a6040, 0x1, 0x484dde5})
        /Users/ccapurso/go/pkg/mod/github.com/hashicorp/go-secure-stdlib/kv-builder@v0.1.1/builder.go:32 +0x89
github.com/hashicorp/vault/command.parseArgsData({0x6449e40, 0xc000194000}, {0xc0001a6040, 0x1, 0x1})
        /Users/ccapurso/git/vault/command/base_helpers.go:134 +0xaa
github.com/hashicorp/vault/command.(*KVPutCommand).Run(0xc0008cab20, {0xc0001a6030, 0x2, 0x2})
        /Users/ccapurso/git/vault/command/kv_put.go:120 +0x171
github.com/mitchellh/cli.(*CLI).Run(0xc000145cc0)
        /Users/ccapurso/go/pkg/mod/github.com/mitchellh/cli@v1.1.2/cli.go:262 +0x5f8
github.com/hashicorp/vault/command.RunCustom({0xc0001a6010, 0x4, 0x4}, 0xc0000001a0)
        /Users/ccapurso/git/vault/command/main.go:180 +0x9f7
github.com/hashicorp/vault/command.Run(...)
        /Users/ccapurso/git/vault/command/main.go:88
main.main()
        /Users/ccapurso/git/vault/main.go:10 +0x52

After change:

❯ vault kv put secret/foo 'bar=\'
= Secret Path =
secret/data/foo

======= Metadata =======
Key                Value
---                -----
created_time       2022-03-15T14:38:07.024316Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1
❯ vault kv get secret/foo
= Secret Path =
secret/data/foo

======= Metadata =======
Key                Value
---                -----
created_time       2022-03-15T14:38:07.024316Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1

=== Data ===
Key    Value
---    -----
bar    \

@hashicorp-cla
Copy link

hashicorp-cla commented Mar 28, 2022

CLA assistant check
All committers have signed the CLA.

@vercel vercel bot temporarily deployed to Preview – vault March 28, 2022 15:06 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 28, 2022 15:09 Inactive
Copy link
Contributor

@HridoyRoy HridoyRoy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't seem like there are any changes here. Is this PR good to close?

@vercel vercel bot temporarily deployed to Preview – vault March 28, 2022 17:16 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 28, 2022 17:16 Inactive
@ccapurso ccapurso force-pushed the backport/vault-4242/currently-sharing-ewe branch from 0f9e907 to 0564771 Compare March 28, 2022 17:16
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 28, 2022 17:17 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 28, 2022 17:17 Inactive
@ccapurso
Copy link
Contributor

Doesn't seem like there are any changes here. Is this PR good to close?

@HridoyRoy, the issue was that the 1.8.x still uses internalshared while 1.9.x and on moved to use go-secure-stdlib. The kvbuilder changes needed to be ported over to internalshared directly from go-secure-stdlib, see hashicorp/go-secure-stdlib#35.

@vercel vercel bot temporarily deployed to Preview – vault March 28, 2022 18:18 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 28, 2022 18:18 Inactive
@ccapurso ccapurso requested a review from HridoyRoy March 28, 2022 18:53
@ccapurso ccapurso merged commit 84ac2d3 into release/1.8.x Mar 28, 2022
@ccapurso ccapurso deleted the backport/vault-4242/currently-sharing-ewe branch March 28, 2022 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants