Skip to content
This repository has been archived by the owner on Jul 26, 2022. It is now read-only.

Fixes naming convention permission check for data items with path attribute. #800

Merged

Conversation

vladlosev
Copy link
Contributor

The permission checking code is currently ignoring the path attributes when evaluating. This results in permission checks for secrets defined like this:

apiVersion: kubernetes-client.io/v1
kind: ExternalSecret
metadata:
  name: test
spec:
  backendType: systemManager
  data:
  - path: dev/team-a/secret

with the error message ERROR, not allowed to fetch secret: test/test: key name undefined does not match naming convention ^dev/team-a/.*.
This PR adds handling of the path attribute in the permissions check.

@vladlosev
Copy link
Contributor Author

@Flydiverny can you please take a look at this? The problem this fixes is also a security vulnerability where the access check is performed on the key attribute whereas the values are fetched using the path attribute.

Copy link
Member

@Flydiverny Flydiverny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the wait, just one minor thought

lib/poller.js Outdated Show resolved Hide resolved
@Flydiverny Flydiverny merged commit 129a518 into external-secrets:master Jul 30, 2021
@vladlosev vladlosev deleted the fix-path-permission-check branch July 30, 2021 05:00
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants