Unique repo path and permissions #8517
Conversation
Codecov Report
@@ Coverage Diff @@
## master #8517 +/- ##
==========================================
- Coverage 42.60% 42.59% -0.02%
==========================================
Files 176 183 +7
Lines 22941 23102 +161
==========================================
+ Hits 9774 9840 +66
- Misses 11770 11853 +83
- Partials 1397 1409 +12
Continue to review full report at Codecov.
|
alexmt
force-pushed
the
unique-repo-path-and-permissions
branch
2 times, most recently
from
958041d to
81f7df8
Compare
alexmt
force-pushed
the
unique-repo-path-and-permissions
branch
from
81f7df8 to
7cecf78
Compare
There was a problem hiding this comment.
Should we go ahead an use the UUIDv4 path generator for this line, too?
argo-cd/reposerver/repository/repository.go
Line 758 in d7fbc91
|
@crenshaw-dev request about |
| return "", err | ||
| } | ||
| tempDir := path.Join(os.TempDir(), newUUID.String()) | ||
| if err := os.Mkdir(tempDir, 0755); err != nil { |
There was a problem hiding this comment.
Do we need 755? Or just 700?
util/grpc/sanitizer.go
Outdated
| for k, v := range s.replacements { | ||
| val = strings.Replace(val, k, v, -1) | ||
| } | ||
| return val |
There was a problem hiding this comment.
Rather than maintain the map everytime we clone a repo, I feel we could have a regexp replace this
func NewSanitizer(root string) {
return &sanitizer{
re: regexp.MustCompile(`(` + root + `/.*?)/`) // non-greedy until next slash after root
}
}
func (s *sanitizer) Replace(val string) string {
return s.re.ReplaceAllString(val, ".")
}There was a problem hiding this comment.
To avoid missing relative paths, we could add a reasonably-unique prefix to the temp dir name and use a regex like this:
no-log-[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}(The end is just a regex for UUIDv4.)
There was a problem hiding this comment.
Another benefit of a keyword-based replace would be that random paths outside the repo dir (like temporary values.yaml files' paths) could be sanitized as well.
empDir := path.Join(os.TempDir(), fmt.Sprintf("no-log-%s", newUUID.String()))There was a problem hiding this comment.
Both approaches also help us completely avoid an attack where someone uses the sanitizer to leak valid paths by forcing errors containing lots of UUIDs. I think that attack is super impractical, but if we can solve two problems at once, great.
There was a problem hiding this comment.
New "sanitizer" is created and deleted every request. So this map will get 2~3 entries max.
Using the gprc interceptor and context was the least intrusive way to introduce sanitization. I really did not want to introduce a lot of copy-paste code. So it forced me to make sanitizer pretty generic . I think regex based sanitization will be useful. Implemented option suggested by @jessesuen because it is less coupled with how we generate unique paths .
…cation Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
…in active use Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
…tory; change repo directory permissions Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
alexmt
force-pushed
the
unique-repo-path-and-permissions
branch
from
7cecf78 to
ec2e2c4
Compare
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
alexmt
force-pushed
the
unique-repo-path-and-permissions
branch
from
ec2e2c4 to
278b27b
Compare
alexmt
force-pushed
the
unique-repo-path-and-permissions
branch
from
8687c23 to
4a1f628
Compare
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
alexmt
force-pushed
the
unique-repo-path-and-permissions
branch
from
4a1f628 to
74001dd
Compare
Unique repo path and permissions (#8517) Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
Unique repo path and permissions (argoproj#8517) Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com> Signed-off-by: wojtekidd <wojtek.cichon@protonmail.com>
Signed-off-by: Alexander Matyushentsev AMatyushentsev@gmail.com
PR implements two changes: