Skip to content

Disallow decrypt_kv jinja filter for fields marked as secret for pack config #4709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jun 26, 2019
Merged

Disallow decrypt_kv jinja filter for fields marked as secret for pack config #4709

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5634bfb
Disallow decrypt_kv jinja filter for fields marked as secret
VineeshJain Jun 11, 2019
f7b4636
Update error message and add test case
VineeshJain Jun 20, 2019
21f8cab
Add testcase for st2api code flow
VineeshJain Jun 25, 2019
5247e89
Remove quotes ` from secret: True and add . in the error message
VineeshJain Jun 20, 2019
c27d200
Add '"' for keywords in error message
VineeshJain Jun 21, 2019
719bddd
Cover for "decrypt_kv" in "default" value of the schema
VineeshJain Jun 24, 2019
35c07a5
Add CHANGELOG entry for PR#4709
VineeshJain Jun 26, 2019
abdf613
Merge branch 'master' into issue/disallowDecryptKVForValuesMarkedSecret
m4dcoder Jun 26, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions st2api/st2api/controllers/v1/pack_configs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,8 @@ def put(self, pack_config_content, pack_ref, requester_user, show_secrets=False)
config_api.validate(validate_against_schema=True)
except jsonschema.ValidationError as e:
raise ValueValidationException(six.text_type(e))
except ValueValidationException as e:
raise ValueValidationException(six.text_type(e))

self._dump_config_to_disk(config_api)

Expand Down
9 changes: 9 additions & 0 deletions st2common/st2common/util/pack.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@
from st2common.constants.pack import PACK_REF_WHITELIST_REGEX
from st2common.content.loader import MetaLoader
from st2common.persistence.pack import Pack
from st2common.exceptions.apivalidation import ValueValidationException
from st2common.util import jinja as jinja_utils

__all__ = [
'get_pack_ref_from_metadata',
Expand Down Expand Up @@ -102,6 +104,13 @@ def validate_config_against_schema(config_schema, config_object, config_path,

pack_name = pack_name or 'unknown'

for key in config_object:
if (jinja_utils.is_jinja_expression(value=config_object.get(key)) and
"decrypt_kv" in config_object.get(key) and config_schema.get(key).get('secret')):
raise ValueValidationException('Validation Error: decrypt_kv jinja filter'
' specified for auto decrypted fields marked'
' with `secret: True`')

schema = util_schema.get_schema_for_resource_parameters(parameters_schema=config_schema,
allow_additional_properties=True)
instance = config_object
Expand Down