E5FE Add string validation to server-tokens annotation by shaun-nx · Pull Request #2733 · nginx/kubernetes-ingress · GitHub
[go: up one dir, main page]
Skip to content

Add string validation to server-tokens annotation #2733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Jun 10, 2022
Merged

Add string validation to server-tokens annotation #2733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
645f8b6
Add string validation to server-token annotation
Jun 2, 2022
0a4091c
Update documentation
Jun 2, 2022
c1da4da
Merge branch 'main' into feature/server-token-validation
Jun 8, 2022
1f6d193
Update regex for server token validation
Jun 9, 2022
2f77409
Fix test
Jun 9, 2022
10BC0
b213740
Add test to disallow `"` in the middle of the string
Jun 9, 2022
614f225
Merge branch 'main' into feature/server-token-validation
Jun 9, 2022
0c39918
Revert cafe-ingress.yaml
Jun 9, 2022
f891e11
Rename regex variables
Jun 9, 2022
04a379c
Merge branch 'main' into feature/server-token-validation
shaun-nx Jun 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion ...tent/configuration/ingress-resources/advanced-configuration-with-annotations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,6 @@ Note how the events section includes a Warning event with the Rejected reason.

The following Ingress annotations currently have limited or no validation:

- `nginx.org/server-tokens`,
- `nginx.org/rewrites`,
- `nginx.com/jwt-key`,
- `nginx.com/jwt-realm`,
Expand Down
13 changes: 12 additions & 1 deletion internal/k8s/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package k8s
import (
"errors"
"fmt"
"regexp"
"sort"
"strings"

Expand Down Expand Up @@ -62,7 +63,9 @@ const (
)

const (
commaDelimiter = ","
commaDelimiter = ","
annotationValueFmt = `([^"$\\]|\\[^$])*`
annotationValueFmtErrMsg = `a valid annotation value must have all '"' escaped and must not contain any '$' or end with an unescaped '\'`
)

type annotationValidationContext struct {
Expand All @@ -84,6 +87,8 @@ type (
validatorFunc func(val string) error
)

var validAnnotationValueRegex = regexp.MustCompile("^" + annotationValueFmt + "$")

var (
// annotationValidations defines the various validations which will be applied in order to each ingress annotation.
// If any specified validation fails, the remaining validations for that annotation will not be run.
Expand Down Expand Up @@ -429,11 +434,17 @@ func validateLBMethodAnnotation(context *annotationValidationContext) field.Erro

func validateServerTokensAnnotation(context *annotationValidationContext) field.ErrorList {
allErrs := field.ErrorList{}

if !context.isPlus {
if _, err := configs.ParseBool(context.value); err != nil {
return append(allErrs, field.Invalid(context.fieldPath, context.value, "must be a boolean"))
}
}

if !validAnnotationValueRegex.MatchString(context.value) {
allErrs = append(allErrs, field.Invalid(context.fieldPath, context.value, annotationValueFmtErrMsg))
}

return allErrs
}

Expand Down
42 changes: 42 additions & 0 deletions internal/k8s/validation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -576,6 +576,48 @@ func TestValidateNginxIngressAnnotations(t *testing.T) {
},
msg: "invalid nginx.org/server-tokens annotation, must be a boolean",
},
{
annotations: map[string]string{
"nginx.org/server-tokens": "$custom_setting",
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
`annotations.nginx.org/server-tokens: Invalid value: "$custom_setting": ` + annotationValueFmtErrMsg,
},
msg: "invalid nginx.org/server-tokens annotation, " + annotationValueFmtErrMsg,
},
{
annotations: map[string]string{
"nginx.org/server-tokens": "custom_\"setting",
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
`annotations.nginx.org/server-tokens: Invalid value: "custom_\"setting": ` + annotationValueFmtErrMsg,
},
msg: "invalid nginx.org/server-tokens annotation, " + annotationValueFmtErrMsg,
},
{
annotations: map[string]string{
"nginx.org/server-tokens": `custom_setting\`,
},
specServices: map[string]bool{},
isPlus: true,
appProtectEnabled: false,
appProtectDosEnabled: false,
internalRoutesEnabled: false,
expectedErrors: []string{
`annotations.nginx.org/server-tokens: Invalid value: "custom_setting\\": ` + annotationValueFmtErrMsg,
},
msg: "invalid nginx.org/server-tokens annotation, " + annotationValueFmtErrMsg,
},

{
annotations: map[string]string{
Expand Down
0