DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

validate value in custom headers

Browse source
This commit is contained in:
Christian Groschupp 2023-06-13 15:50:39 +02:00
parent ba3525bf88
commit 3673b3668b
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
internal/ingress/annotations/customheaders/main.go
View file

@ -37,6 +37,7 @@ type Config struct {
var ( var (
headerRegexp = regexp.MustCompile(`^[a-zA-Z\d\-_]+$`) headerRegexp = regexp.MustCompile(`^[a-zA-Z\d\-_]+$`)
valueRegexp = regexp.MustCompile(`^[a-zA-Z\d\_ :;.,\/"'?!(){}[]@<>=-\+\*#$&<|~^%]+$`)
) )
// ValidHeader checks is the provided string satisfies the header's name regex // ValidHeader checks is the provided string satisfies the header's name regex
@ -44,6 +45,11 @@ func ValidHeader(header string) bool {
return headerRegexp.MatchString(header) return headerRegexp.MatchString(header)
} }
// ValidValue checks is the provided string satisfies the value regex
func ValidValue(header string) bool {
return valueRegexp.MatchString(header)
}
type customHeaders struct { type customHeaders struct {
r resolver.Resolver r resolver.Resolver
} }
@ -70,10 +76,13 @@ func (a customHeaders) Parse(ing *networking.Ingress) (interface{}, error) {
return nil, ing_errors.NewLocationDenied(fmt.Sprintf("unable to find configMap %q", clientHeadersConfigMapName)) return nil, ing_errors.NewLocationDenied(fmt.Sprintf("unable to find configMap %q", clientHeadersConfigMapName))
} }
for header := range clientHeadersMapContents.Data { for header, value := range clientHeadersMapContents.Data {
if !ValidHeader(header) { if !ValidHeader(header) {
return nil, ing_errors.NewLocationDenied("invalid client-headers in configmap") return nil, ing_errors.NewLocationDenied("invalid client-headers in configmap")
} }
if !ValidValue(value) {
return nil, ing_errors.NewLocationDenied("invalid client-headers in configmap")
}
if !slices.Contains(defBackend.AllowedResponseHeaders, header) { if !slices.Contains(defBackend.AllowedResponseHeaders, header) {
return nil, ing_errors.NewLocationDenied(fmt.Sprintf("header %s is not allowed, defined allowed headers inside global-allowed-response-headers %v", header, defBackend.AllowedResponseHeaders)) return nil, ing_errors.NewLocationDenied(fmt.Sprintf("header %s is not allowed, defined allowed headers inside global-allowed-response-headers %v", header, defBackend.AllowedResponseHeaders))
} }