fix(security): support directory paths with path separators in secret keys

changelog.d/24780_secret_resolution_with_path_separators.fix.md

@@ -0,0 +1,4 @@
+Fixed an issue where directory secret backends failed to resolve secrets organized in subdirectories
+(e.g., Kubernetes mounted secrets at paths like: `/secrets/my-secrets/username`)
+
+authors: pront vparfonov

src/config/loading/secret.rs

@@ -25,10 +25,11 @@ use crate::{
 // - "SECRET[backend.secret_name]" will match and capture "backend" and "secret_name"
 // - "SECRET[backend.secret.name]" will match and capture "backend" and "secret.name"
 // - "SECRET[backend..secret.name]" will match and capture "backend" and ".secret.name"
+// - "SECRET[backend.path/to/secret]" will match and capture "backend" and "path/to/secret"
 // - "SECRET[secret_name]" will not match
 // - "SECRET[.secret.name]" will not match
 pub static COLLECTOR: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r"SECRET\[([[:word:]]+)\.([[:word:].-]+)\]").unwrap());
+    LazyLock::new(|| Regex::new(r"SECRET\[([[:word:]]+)\.([[:word:].\-/]+)\]").unwrap());
 
 /// Helper type for specifically deserializing secrets backends.
 #[derive(Debug, Default, Deserialize, Serialize)]
@@ -182,6 +183,8 @@ mod tests {
         let secrets: HashMap<String, String> = vec![
             ("a.secret.key".into(), "value".into()),
             ("a...key".into(), "a...value".into()),
+            ("backend.path/to/secret".into(), "secret_value".into()),
+            ("backend.nested/dir/file".into(), "nested_value".into()),
         ]
         .into_iter()
         .collect();
@@ -203,6 +206,14 @@ mod tests {
             Ok("a...value".into()),
             interpolate("SECRET[a...key]", &secrets)
         );
+        assert_eq!(
+            Ok("secret_value".into()),
+            interpolate("SECRET[backend.path/to/secret]", &secrets)
+        );
+        assert_eq!(
+            Ok("nested_value".into()),
+            interpolate("SECRET[backend.nested/dir/file]", &secrets)
+        );
         assert_eq!(
             Ok("xxxSECRET[non_matching_syntax]yyy".into()),
             interpolate("xxxSECRET[non_matching_syntax]yyy", &secrets)
@@ -227,6 +238,8 @@ mod tests {
             SECRET[second_backend.secret.key]
             SECRET[first_backend.a_third.secret_key]
             SECRET[first_backend...an_extra_secret_key]
+            SECRET[first_backend.path/to/secret]
+            SECRET[second_backend.nested/dir/secret]
             SECRET[non_matching_syntax]
             SECRET[.non.matching.syntax]
         "},
@@ -237,17 +250,19 @@ mod tests {
         assert!(keys.contains_key("second_backend"));
 
         let first_backend_keys = keys.get("first_backend").unwrap();
-        assert_eq!(first_backend_keys.len(), 5);
+        assert_eq!(first_backend_keys.len(), 6);
         assert!(first_backend_keys.contains("secret_key"));
         assert!(first_backend_keys.contains("secret-key"));
         assert!(first_backend_keys.contains("another_secret_key"));
         assert!(first_backend_keys.contains("a_third.secret_key"));
         assert!(first_backend_keys.contains("..an_extra_secret_key"));
+        assert!(first_backend_keys.contains("path/to/secret"));
 
         let second_backend_keys = keys.get("second_backend").unwrap();
-        assert_eq!(second_backend_keys.len(), 2);
+        assert_eq!(second_backend_keys.len(), 3);
         assert!(second_backend_keys.contains("secret_key"));
         assert!(second_backend_keys.contains("secret.key"));
+        assert!(second_backend_keys.contains("nested/dir/secret"));
     }
 
     #[test]

tests/behavior/config/secret.toml

@@ -23,6 +23,8 @@
   .foobarbaz = "SECRET[exec_backend.def]"
   .foobarbazqux = "SECRET[file_backend.ghi]"
   .foobarbazquxquux = "SECRET[directory_backend.jkl]"
+  .nested_path_username = "SECRET[directory_backend.nested/username]"
+  .nested_path_password = "SECRET[directory_backend.nested/password]"
   '''
 
 [[tests]]
@@ -40,4 +42,6 @@
       .foobarbaz == "def.retrieved"
       .foobarbazqux == "ghi.retrieved"
       .foobarbazquxquux == "jkl.retrieved"
+      .nested_path_username == "Gandalf"
+      .nested_path_password == "YouShallNotPass"
       '''

tests/data/secret-backends/directory-secrets/nested/password

@@ -0,0 +1 @@
+YouShallNotPass

tests/data/secret-backends/directory-secrets/nested/username

@@ -0,0 +1 @@
+Gandalf