gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-15 00:22:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #787 from openziti/dont-allow-hash-at-on-attr

Browse Source 
Don't allow hashtags or at symbols on role attributes. Fixes #786
This commit is contained in:
Paul Lorenz
2021-09-22 13:56:23 -04:00
committed by GitHub
parent 1fb58108bf 0c8206b8d4
commit ec3547b7b1
4 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/persistence/edge_router_store.go
+1
View File
@@ -85,6 +85,7 @@ func (entity *EdgeRouter) SetValues(ctx *boltz.PersistContext) {
ctx.SetBool(FieldEdgeRouterIsVerified, entity.IsVerified)
ctx.SetStringP(FieldEdgeRouterHostname, entity.Hostname)
ctx.SetMap(FieldEdgeRouterProtocols, toStringInterfaceMap(entity.EdgeRouterProtocols))
store.validateRoleAttributes(entity.RoleAttributes, ctx.Bucket)
ctx.SetStringList(FieldRoleAttributes, entity.RoleAttributes)
ctx.SetBool(FieldEdgeRouterIsTunnelerEnabled, entity.IsTunnelerEnabled)
ctx.Bucket.PutMap(FieldEdgeRouterAppData, entity.AppData, ctx.FieldChecker, false)
controller/persistence/edge_service_store.go
+1
View File
@@ -67,6 +67,7 @@ func (entity *EdgeService) SetValues(ctx *boltz.PersistContext) {
store := ctx.Store.(*edgeServiceStoreImpl)
ctx.SetString(FieldName, entity.Name)
store.validateRoleAttributes(entity.RoleAttributes, ctx.Bucket)
ctx.SetStringList(FieldRoleAttributes, entity.RoleAttributes)
ctx.SetLinkedIds(EntityTypeConfigs, entity.Configs)
ctx.SetBool(FieldServiceEncryptionRequired, entity.EncryptionRequired)
controller/persistence/identity_store.go
+1
View File
@@ -160,6 +160,7 @@ func (entity *Identity) SetValues(ctx *boltz.PersistContext) {
ctx.Bucket.SetError(errors.New("cannot change type of router identity"))
}
}
store.validateRoleAttributes(entity.RoleAttributes, ctx.Bucket)
ctx.SetStringList(FieldRoleAttributes, entity.RoleAttributes)
ctx.SetInt32(FieldIdentityDefaultHostingPrecedence, int32(entity.DefaultHostingPrecedence))
ctx.SetInt32(FieldIdentityDefaultHostingCost, int32(entity.DefaultHostingCost))
controller/persistence/policy_common.go
+13
View File
@@ -79,6 +79,19 @@ func (self *roleAttributeChangeContext) addServicePolicyEvent(identityId, servic
self.addServiceEvent(self.tx, identityId, serviceId, eventType)
}
func (store *baseStore) validateRoleAttributes(attributes []string, holder errorz.ErrorHolder) {
for _, attr := range attributes {
if strings.HasPrefix(attr, "#") {
holder.SetError(errorz.NewFieldError("role attributes may not be prefixed with #", "roleAttributes", attr))
return
}
if strings.HasPrefix(attr, "@") {
holder.SetError(errorz.NewFieldError("role attributes may not be prefixed with @", "roleAttributes", attr))
return
}
}
}
func (store *baseStore) updateServicePolicyRelatedRoles(ctx *roleAttributeChangeContext, entityId []byte, newRoleAttributes []boltz.FieldTypeAndValue) {
cursor := ctx.rolesSymbol.GetStore().IterateIds(ctx.tx, ast.BoolNodeTrue)