The remote URL of a Terraform module can embed credentials (for example
https://user:token@host/repo.git). The cache-reuse logic logged the raw URL
and wrote it to the .remote-url cache marker, which could leak those
credentials into controller logs and onto disk.
Strip the userinfo from the URL before logging it and before writing the cache
marker. The marker now stores a credential-free URL and the reuse check
compares the same stripped form, so cache reuse and re-clone-on-change behave
as before while no secret is persisted.
Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>
Wrap the cache remote marker read in filepath.Clean, the same pattern
other os.ReadFile call sites in this repo use to satisfy gosec. The
path is built from filepath.Join and a constant suffix, with the module
name validated beforehand, so behavior is unchanged.
The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge
because the advisory workflow did not run the full lint job.
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* fix: prevent unbounded read in Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x)
* fix: bound remote Terraform clone and invalidate cache on rejection
Follow-up hardening for GHSA-fmgp-q6jx-gg3x.
Bound the clone of the attacker-supplied repository: shallow Depth:1, a
2-minute fetch timeout via PlainCloneContext, and post-clone caps on the
retained tree size (64 MiB) and file count, rejecting and removing a clone
that exceeds them.
Invalidate the clone cache: re-clone when the recorded remote URL changes,
and remove the cache on a failed clone or a rejected read so a corrected
repository is re-fetched instead of a poisoned or stale tree being reused.
Validate the module name before building the cache path, and log clone,
rejection, and eviction events.
* Feat: support to manage the integrations by the CLI and the workflow
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: remove the xml
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: add the unit test for the nacos writer
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add the integration API
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: make the provider commands to be deprecated
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: make the unit test work
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: rename the integration to the config
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: make the unit test cases work
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: refactor the config commands
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add the distribution status for the config
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: sort the import packages
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: refine the code style
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: refine the code style
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: get the content format before render the content
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add some examples
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: the command test cases
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add the definitions of the workflow step
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: add some tests
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: add some tests
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: change the name
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: retry the CI
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: refine some words
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: provider can't be added since 1.4 as context abused
Signed-off-by: Jianbo Sun <jianbo.sjb@alibaba-inc.com>
* Feat: add cache for remote terraform module in vela show
Signed-off-by: Jianbo Sun <jianbo.sjb@alibaba-inc.com>
* Fix: add message for terraform resource in error state
Signed-off-by: Jianbo Sun <jianbo.sjb@alibaba-inc.com>
* Fix: The policy controller generate the OpenAPI schema (#3683)
Signed-off-by: DESKTOP-FV8IFEC\10690 <1069029381@qq.com>
* Feat(lang): The policy controller generate the OpenAPI schema (#3683)
The policy controller does not generate the OpenAPI schema #3683
add CapabilityPolicyDefinition struct comment
add StoreOpenAPISchema of CapabilityPolicyDefinition comment
Signed-off-by: fengkang <fengkangb@digitalchina.com>
* Feat(lang): The policy controller generate the OpenAPI schema (#3683)
The policy controller does not generate the OpenAPI schema #3683
fix unit-test
Signed-off-by: fengkang <fengkangb@digitalchina.com>
* Feat(lang): The policy controller generate the OpenAPI schema (#3683)
fix unit-test about policydefinition_controller_test.go
The policy controller does not generate the OpenAPI schema #3683
fix unit-test
Signed-off-by: fengkang <fengkangb@digitalchina.com>
* Feat(lang): The policy controller generate the OpenAPI schema (#3683)
fix unit-test about policydefinition_controller_test.go
Signed-off-by: fengkang <fengkangb@digitalchina.com>
* Feat(lang): The policy controller generate the OpenAPI schema (#3683) gen crd
Signed-off-by: fengkang <fengkangb@digitalchina.com>
* Feat(lang): The policy controller generate the OpenAPI schema (#3683) make reviewable
Signed-off-by: fengkang01 <fengkangb@digitalchina.com>
Co-authored-by: DESKTOP-FV8IFEC\10690 <1069029381@qq.com>
* Fix: retrieve Terraform variables from variables.tf
If Terraform modules/resources are stored in remote git repos, get
variables from file `varialbes.tf`, or from `main.tf`.
Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>
* Fix: Generate doc for Terraform typed ComponentDefinition
When the configuration of a Terraform Typed ComponentDefinition is in
remote Git, generate the properties for it. And generated outputs for
all Terraform ComponentDefinition
Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>
* Fix: add more fields for Terraform types definitions in api schema
Added `writeConnectionStringSecrecto`, `region` and `deleteResoruce`
fields for Terraform types definitions in OpenAPI schema
* fix ci issue
* fix header
* Feat(rollout): fill rolloutBatches if empty when scale up/down (#2569)
* Feat: fill rolloutBatches if empty
* Fix: fix unit-test
* Test: add more test
Fix: lint
Fix: fix lint
* Update release.yml (#2537)
* Feat: add registry, merge registry and cap center (#2528)
* Feat: add registry command
* Refactor: comp/trait command combine with registry
* Feat: refactor `vela comp/trait`
* Fix: import
* Fix: fix if type is autodetects.core.oam.dev
* Fix: fix list from url
* Fix: test
* Feat: add test
* Fix: remove dup test
* Fix: test
* Fix: test
* Fix: fix label filter
* Fix: reviewable
* Fix test
* fix personal repo in test
* Fix test
* Fix test
* add some boundary check
* reviewable
* Fix: fix nocalhost trait (#2577)
* fix incorrect addon status (#2576)
* Fix(cli): client-side throttling in vela CLI (#2581)
* fix cli throttling
* fix import
* set to a lower value
* remove addon with no defs (#2574)
* Feat: vela logs support multicluster (#2593)
* Feat: add basic multiple cluster logs
* fix context
* Fix select style
* Fix select style
* remove useless env
* fix naming
* Feat: vela cluster support use ocm to join/list/detach cluster (#2599)
* Feat: add render component and apply component remaining (#2587)
* Feat: add render component and apply component remaining
* fix ut
* fix e2e
* allow import package in custom status cue template (#2585)
Co-authored-by: chwetion <chwetion@foxmail.com>
* Fix: abnormal aux name (#2612)
* Feat: store workflow step def properties in cm (#2592)
* Fix: fix notification def
* Feat: store workflow step def properties in cm
* fix ci
* fix data race
* Fix: change Initializer to Application for addon Observability (#2615)
In this doc, updated the Observability implementation from initializer
to Application. I also store definitions as it's not well stored in
vela-templates/addons/observability
* Fix: fix backport param (#2611)
* Fix: add owner reference in workflow context cm (#2573)
* Fix: add owner reference in workflow context cm
* fix ci
* delete useless test case
* Fix: op.delete bugs (#2622)
* Fix: op.delete some bugs
* Fix: app status update error
Fix: make reviewable
* Fix: show reconcile error log (#2626)
* Feat: add reconcile timeout configuration for vela-core (#2630)
* Fix: patch status retry while conflict happens (#2629)
* Fix: allow definition schema cm can be same name in different definition type (#2618)
* Fix: fix definition schema cm name
* fix ut
* fix ut
* fix show
* add switch default case
* Feat: remove envbinding policy into workflow (#2556)
Fix: add more test
* Feat: add vela prob to test cluster (#2635)
* Fix: upgrade stern lib to avoid panic for vela logs (#2650)
* Fix: filter loggable workload in vela logs (#2651)
* Fix: filter loggable workload in vela logs
* reviewable
* Feat: add vela exec for multi cluster (#2299)
fix
support vela exec
* Fix: health check will check for multiclusters (#2645)
* Fix: minor fix for vela cli printing (#2655)
* Fix: minor fix for vela cli printing
* add dockerfile go mod cache
* Feat: support apiserver-related multicluster features (#2625)
* Feat: remove envbinding policy into workflow
Feat: add support for env change (env gc)
Fix: fix rollout timeout setting bug
* Feat: support disable trait and env without workflow
* Fix: add hint for replaced value
Co-authored-by: wyike <wangyike_wyk@163.com>
Co-authored-by: basefas <basefas@hotmail.com>
Co-authored-by: qiaozp <47812250+chivalryq@users.noreply.github.com>
Co-authored-by: Tianxin Dong <dongtianxin.tx@alibaba-inc.com>
Co-authored-by: yangsoon <yangsoonlx@gmail.com>
Co-authored-by: Chwetion <137953601@qq.com>
Co-authored-by: chwetion <chwetion@foxmail.com>
Co-authored-by: Jian.Li <74582607+leejanee@users.noreply.github.com>
Co-authored-by: Zheng Xi Zhou <zzxwill@gmail.com>
Co-authored-by: Jianbo Sun <jianbo.sjb@alibaba-inc.com>
* vela show support show the paramters of KUBE model ComponentDefinition
* fix
* fix
fix
* enchance test case and add function in show -web
fmt and vet
fix
fix522
* add resolve for kubedef type trait in reconcil process
* fix StoreOpenAPISchema args para and ret para
* fix GetCapabilityObject uncover
* Support cloud resource provisioning and consuming (Crossplane)
Provided a way to store secret for cloud resource generated by
Crossplane and to consume the secret
Refer to #1128
* Separate cloud resource producer and consumer in two applications
* add unit test to check whether application can consume cloud resource secret
* update Cloud Resource doc
* Provisioning and consuming cloud resource in different applications v1 (one cloud resource)
* one component consumes two cloud resources
Co-authored-by: Jianbo Sun <wonderflow.sun@gmail.com>
* implemente kube schematic
generate schema for kube schematic parameters
add e2e test
Signed-off-by: roywang <seiwy2010@gmail.com>
* add unit test
Signed-off-by: roy wang <seiwy2010@gmail.com>
* add doc
Signed-off-by: roy wang <seiwy2010@gmail.com>
* get JSON schema for Helm schematic ComponentDefinition
Signed-off-by: roy wang <seiwy2010@gmail.com>
* add e2e test
update doc
add unit tests
Signed-off-by: roywang <seiwy2010@gmail.com>
Ayush KumarandGitHub
Tianxin DongandGitHub
SomefiveandGitHub
Joshua AgboolaandGitHub
barnettZQGandGitHub
Tianxin DongandGitHub
Jianbo SunandGitHub
Zheng Xi ZhouandGitHub
qiaozpandGitHub
wangyuan249andGitHub
Yue WangandGitHub
