Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Protect against user injection for registration CLI page #823

Merged
merged 6 commits into from
Oct 4, 2022
Merged

Protect against user injection for registration CLI page #823

merged 6 commits into from
Oct 4, 2022

Commits on Sep 23, 2022

  1. Protect against user injection for registration CLI page 

    This commit addresses a potential issue where we allowed unsanitised
content to be passed through a go template without validation.

We now try to unmarshall the incoming node key and fails to render the
template if it is not a valid node key.

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
    @kradalby
    kradalby committed Sep 23, 2022
    Configuration menu
    Copy the full SHA
    93082b8 View commit details
    Browse the repository at this point in the history

  2. Update changelog 

    Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
    @kradalby
    kradalby committed Sep 23, 2022
    Configuration menu
    Copy the full SHA
    75a8fc8 View commit details
    Browse the repository at this point in the history

  3. Merge branch 'main' into sanitise-machine-key-url

    @kradalby
    kradalby authored Sep 23, 2022
    Configuration menu
    Copy the full SHA
    d06ba7b View commit details
    Browse the repository at this point in the history

  4. Validate the incoming nodekey with regex before attempting to parse 

    Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
    @kradalby
    kradalby committed Sep 23, 2022
    Configuration menu
    Copy the full SHA
    2bb3475 View commit details
    Browse the repository at this point in the history

  5. gofumpt 

    Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
    @kradalby
    kradalby committed Sep 23, 2022
    Configuration menu
    Copy the full SHA
    8be14ef View commit details
    Browse the repository at this point in the history

Commits on Oct 4, 2022

  1. Merge branch 'main' into sanitise-machine-key-url

    @juanfont
    juanfont authored Oct 4, 2022
    Configuration menu
    Copy the full SHA
    5333df2 View commit details
    Browse the repository at this point in the history