Mirrors/flux2
1
0
Fork 0
mirror of synced 2026-02-06 10:55:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add safe guards for relative paths

Browse Source 
This commit adds multiple safe guards for relative paths, ensuring they
never traverse outside the working directory.

The `SafeRelativePath` flag calculates the safe relative path based on a
relative base dir, which results in a flattened path.

The write methods of `manifestgen` make use of the `SecureJoin` as well,
to ensure writes are never outside of the given directory when used as
a lib outside of the CLI.

Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit is contained in:
Hidde Beydals
2020-12-14 14:21:41 +01:00
parent 008b3b8408
commit 5ea4e814f5
13 changed files with 180 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/cmd/flux_bootstrap_github.md
View File

@@ -46,16 +46,16 @@ flux bootstrap github [flags]
### Options
```
-h, --help help for github
--hostname string GitHub hostname (default "github.com")
--interval duration sync interval (default 1m0s)
--owner string GitHub user or organization name
--path string repository path, when specified the cluster sync will be scoped to this path
--personal is personal repository
--private is private repository (default true)
--repository string GitHub repository name
--ssh-hostname string GitHub SSH hostname, to be used when the SSH host differs from the HTTPS one
--team stringArray GitHub team to be given maintainer access
-h, --help help for github
--hostname string GitHub hostname (default "github.com")
--interval duration sync interval (default 1m0s)
--owner string GitHub user or organization name
--path safeRelativePath path relative to the repository root, when specified the cluster sync will be scoped to this path
--personal is personal repository
--private is private repository (default true)
--repository string GitHub repository name
--ssh-hostname string GitHub SSH hostname, to be used when the SSH host differs from the HTTPS one
--team stringArray GitHub team to be given maintainer access
```
### Options inherited from parent commands

18
docs/cmd/flux_bootstrap_gitlab.md
View File

@@ -43,15 +43,15 @@ flux bootstrap gitlab [flags]
### Options
```
-h, --help help for gitlab
--hostname string GitLab hostname (default "gitlab.com")
--interval duration sync interval (default 1m0s)
--owner string GitLab user or group name
--path string repository path, when specified the cluster sync will be scoped to this path
--personal is personal repository
--private is private repository (default true)
--repository string GitLab repository name
--ssh-hostname string GitLab SSH hostname, to be used when the SSH host differs from the HTTPS one
-h, --help help for gitlab
--hostname string GitLab hostname (default "gitlab.com")
--interval duration sync interval (default 1m0s)
--owner string GitLab user or group name
--path safeRelativePath path relative to the repository root, when specified the cluster sync will be scoped to this path
--personal is personal repository
--private is private repository (default true)
--repository string GitLab repository name
--ssh-hostname string GitLab SSH hostname, to be used when the SSH host differs from the HTTPS one
```
### Options inherited from parent commands

2
docs/cmd/flux_create_kustomization.md
View File

@@ -50,7 +50,7 @@ flux create kustomization [name] [flags]
--health-check stringArray workload to be included in the health assessment, in the format '<kind>/<name>.<namespace>'
--health-check-timeout duration timeout of health checking operations (default 2m0s)
-h, --help help for kustomization
--path string path to the directory containing a kustomization.yaml file (default "./")
--path safeRelativePath path to the directory containing a kustomization.yaml file (default ./)
--prune enable garbage collection
--service-account string the name of the service account to impersonate when reconciling this Kustomization
--source kustomizationSource source that contains the Kubernetes manifests in the format '[<kind>/]<name>',where kind can be one of: (GitRepository, Bucket), if kind is not specified it defaults to GitRepository