Add an validator to verify correctness of ProxyUrl string/secret

[aorcholski]

Description
ActiveGate Proxy URL has to be properly encoded URI. ActiveGate POD fails if Proxy URL contains special characters (for instance "?) unencoded. To improve user experience I propose to add an Validator to reject a CR if the Proxy value or Proxy secret is invalid.

How can this be tested?
Use any unencoded special character(s) in the Proxy Url (proxy.value, proxy secret) and try to apply your CR - should be rejected.

Checklist

• Unit tests have been updated/added
• PR is labeled accordingly

[meik99]

use errors.New() from the pkg/errors library

[aorcholski]

Done

[meik99]

use errors.Wrap() from the pkg/errors libraries

[aorcholski]

Done

[meik99]

does that mean it must be either escaped or encoded or must it be both?
If it must be both, would that then work with the dtclient, since it would take the password unencoded?

[aorcholski]

my fault, characters can not be escaped

[meik99]

introduce a local constant for the null character just so it is more obvious that that magic number is supposed to be that character

[aorcholski]

Characters can not be escaped due to dtclient (which uses the same password) so the logic is simpler - apostrophe and backtick are forbidden. The function has been renamed to evalIsStringInvalid

[meik99]

as far as I understand, this function would effectively be a block-list, blocking the three known characters. It would be more secure to restructure it to an allow-list, checking that every character is one of the known ones, i.e., letters, numbers and tested special characters and then checking if they are appropriately escaped

[aorcholski]

my fault, characters can not be escaped because of dtclient. Finally, there are two invalid characters : apostrophe and backtick.

[meik99]

With so many specifc errors (and also logic), this code and other proxy validation code should probably belong into a separate file, e.g., "validation/proxy.go"

[aorcholski]

done

[meik99]

This implements a blocklist again, please rewrite that function to return true anytime it encounters an unkown character

[meik99]

Something like this would implement an allowlist, only permitting the characters in the brackets to be used

func isStringValidForEval(str string) bool {
	regex := regexp.MustCompile(`^[a-zA-Z0-9./?,*;\\ ]+$`)
	return regex.MatchString(str)
}

func TestAllowList(t *testing.T) {
	assert.True(t, isStringValidForEval("a simple password"))
	assert.True(t, isStringValidForEval("a simple password w1th sp?cial ;; chara/cters"))
	assert.False(t, isStringValidForEval("A ` backtick"))
	assert.False(t, isStringValidForEval("A ' single quote"))
}

[aorcholski]

regex is used

[meik99]

sorry I didn't see that during the first review. There is assert.True and assert.False for these kinds of assertions. Otherweise lgmt

[aorcholski]

good point, fixed