Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid exposing sensitive data to client (#1543)

Browse Source 
This PR changes the behavior of controller API which
wrongly exposes sensitive data to the client. Now, the
API only returns success if secret/configmap exists;
otherwise, an error will be returned.
This commit is contained in:
Ta-Ching Chen
2020-02-24 20:02:33 +08:00
committed by GitHub
parent fc5711ce7c
commit 5c09099084
8 changed files with 27 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/api.go
+2 -2
View File
@@ -239,8 +239,8 @@ func (api *API) GetHandler() http.Handler {
r.HandleFunc("/v2/triggers/messagequeue/{mqTrigger}", api.MessageQueueTriggerApiUpdate).Methods("PUT")
r.HandleFunc("/v2/triggers/messagequeue/{mqTrigger}", api.MessageQueueTriggerApiDelete).Methods("DELETE")
r.HandleFunc("/v2/secrets/{secret}", api.SecretGet).Methods("GET")
r.HandleFunc("/v2/configmaps/{configmap}", api.ConfigMapGet).Methods("GET")
r.HandleFunc("/v2/secrets/{secret}", api.SecretExists).Methods("GET")
r.HandleFunc("/v2/configmaps/{configmap}", api.ConfigMapExists).Methods("GET")
r.HandleFunc("/v2/canaryconfigs", api.CanaryConfigApiCreate).Methods("POST")
r.HandleFunc("/v2/canaryconfigs/{canaryConfig}", api.CanaryConfigApiGet).Methods("GET")