github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sec): corrects validation for regex objects (hostname and forbidden (#1983)

Browse Source 
* fix(controller): decode old object for delete requests

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* chore: modernize golang

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>

* fix: preserve ca-bundles injected from external providers

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix(sec): corrects validation for regex objects (hostname and forbidden metadata)

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
2026-06-24 11:33:34 +02:00
committed by GitHub
parent 755cef54bf
commit 8d89d6865d
4 changed files with 134 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/webhook/tenant/validation/forbidden_annotations_regex.go
+14 -5
View File
@@ -68,18 +68,27 @@ func (h *forbiddenAnnotationsRegexHandler) OnUpdate(
}
func (h *forbiddenAnnotationsRegexHandler) validate(tnt *capsulev1beta2.Tenant, req admission.Request) *admission.Response {
if tnt.Spec.NamespaceOptions == nil {
if tnt == nil || tnt.Spec.NamespaceOptions == nil {
return nil
}
annotationsToCheck := map[string]string{
regexesToCheck := map[string]string{
"labels": tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex,
"annotations": tnt.Spec.NamespaceOptions.ForbiddenAnnotations.Regex,
}
for scope, annotation := range annotationsToCheck {
if _, err := regexp.Compile(tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex); err != nil {
return ad.Denyf("unable to compile %s regex for forbidden %s", annotation, scope)
for scope, expression := range regexesToCheck {
if expression == "" {
continue
}
if _, err := regexp.Compile(expression); err != nil {
return ad.Denyf(
"unable to compile regex %q for forbidden %s: %v",
expression,
scope,
err,
)
}
}
internal/webhook/tenant/validation/hostname_regex.go
+1 -1
View File
@@ -54,8 +54,8 @@ func (h *hostnameRegexHandler) OnDelete(
func (h *hostnameRegexHandler) OnUpdate(
_ client.Client,
_ client.Reader,
old *capsulev1beta2.Tenant,
tnt *capsulev1beta2.Tenant,
_ *capsulev1beta2.Tenant,
decoder admission.Decoder,
_ events.EventRecorder,
) handlers.Func {