DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

accept wildcard nginx.ingress.kubernetes.io/cors-allow-headers

Browse source
This commit is contained in:
Chris Roemmich 2024-07-18 17:15:42 -05:00
parent 76f90ec8cf
commit d648a2512a
No known key found for this signature in database
GPG key ID: 726EBBCDDD6435EE
2 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
internal/ingress/annotations/cors/main.go
View file

@ -49,9 +49,9 @@ var (
// Method must contain valid methods list (PUT, GET, POST, BLA) // Method must contain valid methods list (PUT, GET, POST, BLA)
// May contain or not spaces between each verb // May contain or not spaces between each verb
corsMethodsRegex = regexp.MustCompile(`^([A-Za-z]+,?\s?)+$`) corsMethodsRegex = regexp.MustCompile(`^([A-Za-z]+,?\s?)+$`)
// Expose Headers must contain valid values only (*, X-HEADER12, X-ABC) // CORS Headers must contain valid values only (*, X-HEADER12, X-ABC)
// May contain or not spaces between each Header // May contain or not spaces between each Header
corsExposeHeadersRegex = regexp.MustCompile(`^(([A-Za-z0-9\-\_]+|\*),?\s?)+$`) corsHeadersRegex = regexp.MustCompile(`^(([A-Za-z0-9\-\_]+|\*),?\s?)+$`)
) )
const ( const (
@ -83,11 +83,11 @@ var corsAnnotation = parser.Annotation{
Protocol can be any lowercase string, like http, https, or mycustomprotocol.`, Protocol can be any lowercase string, like http, https, or mycustomprotocol.`,
}, },
corsAllowHeadersAnnotation: { corsAllowHeadersAnnotation: {
Validator: parser.ValidateRegex(parser.HeadersVariable, true), Validator: parser.ValidateRegex(corsHeadersRegex, true),
Scope: parser.AnnotationScopeIngress, Scope: parser.AnnotationScopeIngress,
Risk: parser.AnnotationRiskMedium, Risk: parser.AnnotationRiskMedium,
Documentation: `This annotation controls which headers are accepted. Documentation: `This annotation controls which headers are accepted.
This is a multi-valued field, separated by ',' and accepts letters, numbers, _ and -`, This is a multi-valued field, separated by ',' and accepts letters, numbers, _, - and *.`,
}, },
corsAllowMethodsAnnotation: { corsAllowMethodsAnnotation: {
Validator: parser.ValidateRegex(corsMethodsRegex, true), Validator: parser.ValidateRegex(corsMethodsRegex, true),
@ -103,7 +103,7 @@ var corsAnnotation = parser.Annotation{
Documentation: `This annotation controls if credentials can be passed during CORS operations.`, Documentation: `This annotation controls if credentials can be passed during CORS operations.`,
}, },
corsExposeHeadersAnnotation: { corsExposeHeadersAnnotation: {
Validator: parser.ValidateRegex(corsExposeHeadersRegex, true), Validator: parser.ValidateRegex(corsHeadersRegex, true),
Scope: parser.AnnotationScopeIngress, Scope: parser.AnnotationScopeIngress,
Risk: parser.AnnotationRiskMedium, Risk: parser.AnnotationRiskMedium,
Documentation: `This annotation controls which headers are exposed to response. Documentation: `This annotation controls which headers are exposed to response.
@ -226,7 +226,7 @@ func (c cors) Parse(ing *networking.Ingress) (interface{}, error) {
} }
config.CorsAllowHeaders, err = parser.GetStringAnnotation(corsAllowHeadersAnnotation, ing, c.annotationConfig.Annotations) config.CorsAllowHeaders, err = parser.GetStringAnnotation(corsAllowHeadersAnnotation, ing, c.annotationConfig.Annotations)
if err != nil || !parser.HeadersVariable.MatchString(config.CorsAllowHeaders) { if err != nil || !corsHeadersRegex.MatchString(config.CorsAllowHeaders) {
config.CorsAllowHeaders = defaultCorsHeaders config.CorsAllowHeaders = defaultCorsHeaders
} }
@ -246,7 +246,7 @@ func (c cors) Parse(ing *networking.Ingress) (interface{}, error) {
} }
config.CorsExposeHeaders, err = parser.GetStringAnnotation(corsExposeHeadersAnnotation, ing, c.annotationConfig.Annotations) config.CorsExposeHeaders, err = parser.GetStringAnnotation(corsExposeHeadersAnnotation, ing, c.annotationConfig.Annotations)
if err != nil || !corsExposeHeadersRegex.MatchString(config.CorsExposeHeaders) { if err != nil || !corsHeadersRegex.MatchString(config.CorsExposeHeaders) {
config.CorsExposeHeaders = "" config.CorsExposeHeaders = ""
} }

4
internal/ingress/annotations/cors/main_test.go
View file

@ -79,7 +79,7 @@ func TestIngressCorsConfigValid(t *testing.T) {
// Valid // Valid
data[parser.GetAnnotationWithPrefix(corsEnableAnnotation)] = enableAnnotation data[parser.GetAnnotationWithPrefix(corsEnableAnnotation)] = enableAnnotation
data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)] = "DNT,X-CustomHeader, Keep-Alive,User-Agent" data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)] = "*, DNT,X-CustomHeader, Keep-Alive,User-Agent"
data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)] = "false" data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)] = "false"
data[parser.GetAnnotationWithPrefix(corsAllowMethodsAnnotation)] = "GET, PATCH" data[parser.GetAnnotationWithPrefix(corsAllowMethodsAnnotation)] = "GET, PATCH"
data[parser.GetAnnotationWithPrefix(corsAllowOriginAnnotation)] = "https://origin123.test.com:4443" data[parser.GetAnnotationWithPrefix(corsAllowOriginAnnotation)] = "https://origin123.test.com:4443"
@ -105,7 +105,7 @@ func TestIngressCorsConfigValid(t *testing.T) {
t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)], nginxCors.CorsAllowCredentials) t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)], nginxCors.CorsAllowCredentials)
} }
if nginxCors.CorsAllowHeaders != "DNT,X-CustomHeader, Keep-Alive,User-Agent" { if nginxCors.CorsAllowHeaders != "*, DNT,X-CustomHeader, Keep-Alive,User-Agent" {
t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)], nginxCors.CorsAllowHeaders) t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)], nginxCors.CorsAllowHeaders)
} }