DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add path validation to implementation specific as well (#9573)

Browse source 
Signed-off-by: James Strong <strong.james.e@gmail.com>
This commit is contained in:
James Strong 2023-02-02 14:28:43 -05:00 committed by GitHub
parent 8296f571c3
commit 0cabaddca0
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/util/ingress/ingress.go
View file

@ -282,9 +282,11 @@ func checkPath(paths []networkingv1.HTTPIngressPath, enablePathTypeValidation bo
switch pathType := *path.PathType; pathType { switch pathType := *path.PathType; pathType {
case networkingv1.PathTypeImplementationSpecific: case networkingv1.PathTypeImplementationSpecific:
//only match on regex chars per Ingress spec when path is implementation specific if enablePathTypeValidation {
if !regexSpecificChars.MatchString(path.Path) { //only match on regex chars per Ingress spec when path is implementation specific
return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) if !regexSpecificChars.MatchString(path.Path) {
return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType)
}
} }
case networkingv1.PathTypeExact, networkingv1.PathTypePrefix: case networkingv1.PathTypeExact, networkingv1.PathTypePrefix:

4
pkg/util/ingress/ingress_test.go
View file

@ -272,7 +272,7 @@ func TestValidateIngressPath(t *testing.T) {
name: "should reject path when the allowed additional set does not match", name: "should reject path when the allowed additional set does not match",
wantErr: true, wantErr: true,
additionalChars: "().?", additionalChars: "().?",
EnablePathTypeValidation: false, EnablePathTypeValidation: true,
copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"),
}, },
{ {
@ -291,7 +291,7 @@ func TestValidateIngressPath(t *testing.T) {
{ {
name: "should block if at least one path is bad", name: "should block if at least one path is bad",
wantErr: true, wantErr: true,
EnablePathTypeValidation: false, EnablePathTypeValidation: true,
copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")), copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")),
}, },
} }