Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid exposing sensitive data to client (#1543)

Browse Source 
This PR changes the behavior of controller API which
wrongly exposes sensitive data to the client. Now, the
API only returns success if secret/configmap exists;
otherwise, an error will be returned.
This commit is contained in:
Ta-Ching Chen
2020-02-24 20:02:33 +08:00
committed by GitHub
parent fc5711ce7c
commit 5c09099084
8 changed files with 27 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/client/v1/fake/fake_misc.go
+5 -6
View File
@@ -17,11 +17,10 @@ limitations under the License.
package fake
import (
v1 "github.com/fission/fission/pkg/controller/client/v1"
"io"
apiv1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
v1 "github.com/fission/fission/pkg/controller/client/v1"
"github.com/fission/fission/pkg/info"
)
@@ -34,12 +33,12 @@ func newMiscClient(c *v1.V1) v1.MiscInterface {
return &FakeMisc{}
}
func (c *FakeMisc) SecretGet(m *metav1.ObjectMeta) (*apiv1.Secret, error) {
return nil, nil
func (c *FakeMisc) SecretExists(m *metav1.ObjectMeta) error {
return nil
}
func (c *FakeMisc) ConfigMapGet(m *metav1.ObjectMeta) (*apiv1.ConfigMap, error) {
return nil, nil
func (c *FakeMisc) ConfigMapExists(m *metav1.ObjectMeta) error {
return nil
}
func (c *FakeMisc) GetSvcURL(label string) (string, error) {
pkg/controller/client/v1/misc.go
+8 -33
View File
@@ -24,7 +24,6 @@ import (
"net/http"
"github.com/pkg/errors"
apiv1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"github.com/fission/fission/pkg/controller/client/rest"
@@ -39,8 +38,8 @@ type (
}
MiscInterface interface {
SecretGet(m *metav1.ObjectMeta) (*apiv1.Secret, error)
ConfigMapGet(m *metav1.ObjectMeta) (*apiv1.ConfigMap, error)
SecretExists(m *metav1.ObjectMeta) error
ConfigMapExists(m *metav1.ObjectMeta) error
GetSvcURL(label string) (string, error)
ServerInfo() (*info.ServerInfo, error)
PodLogs(m *metav1.ObjectMeta) (io.ReadCloser, int, error)
@@ -55,52 +54,28 @@ func newMiscClient(c *V1) MiscInterface {
return &Misc{client: c.restClient}
}
func (c *Misc) SecretGet(m *metav1.ObjectMeta) (*apiv1.Secret, error) {
func (c *Misc) SecretExists(m *metav1.ObjectMeta) error {
relativeUrl := fmt.Sprintf("secrets/%v", m.Name)
relativeUrl += fmt.Sprintf("?namespace=%v", m.Namespace)
resp, err := c.client.Get(relativeUrl)
if err != nil {
return nil, err
return err
}
defer resp.Body.Close()
body, err := handleResponse(resp)
if err != nil {
return nil, err
}
var secret apiv1.Secret
err = json.Unmarshal(body, &secret)
if err != nil {
return nil, err
}
return &secret, nil
return nil
}
func (c *Misc) ConfigMapGet(m *metav1.ObjectMeta) (*apiv1.ConfigMap, error) {
func (c *Misc) ConfigMapExists(m *metav1.ObjectMeta) error {
relativeUrl := fmt.Sprintf("configmaps/%v", m.Name)
relativeUrl += fmt.Sprintf("?namespace=%v", m.Namespace)
resp, err := c.client.Get(relativeUrl)
if err != nil {
return nil, err
return err
}
defer resp.Body.Close()
body, err := handleResponse(resp)
if err != nil {
return nil, err
}
var configMap apiv1.ConfigMap
err = json.Unmarshal(body, &configMap)
if err != nil {
return nil, err
}
return &configMap, nil
return nil
}
func (c *Misc) GetSvcURL(label string) (string, error) {