Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Make release URL as constant type (fix CWE-88) #141

Closed
wants to merge 34 commits into from
+629 −218
Closed

[Security] Make release URL as constant type (fix CWE-88) #141

Changes from 1 commit
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
868e796
Make release URL as constant type
alphaX86 Jan 1, 2022
f39c428
Updated file
unnati914 Jan 1, 2022
462e741
Updated files
unnati914 Jan 2, 2022
80740b0
Merge pull request #142 from unnati914/master
leecalcote Jan 5, 2022
ed97280
chore: Changed version none to edge
Abhijay007 Jan 6, 2022
f401e95
Merge pull request #145 from Abhijay007/chore/Abhijay007/version
leecalcote Jan 6, 2022
eaf234a
fix typos for traefik-mesh name
theBeginner86 Jan 7, 2022
4435ab2
Merge pull request #146 from theBeginner86/fix-typo
leecalcote Jan 7, 2022
2334c63
update e2etest.yaml
theBeginner86 Jan 8, 2022
3818497
fix expected_pods_namespace
theBeginner86 Jan 8, 2022
e627b6e
Merge pull request #147 from theBeginner86/theBeginner86/ci/issue139
Revolyssup Jan 9, 2022
d8172fa
fix minor syntax error in e2etest.yaml
theBeginner86 Jan 9, 2022
b5fee96
Merge pull request #148 from theBeginner86/minor-changes-e2etest
Revolyssup Jan 9, 2022
2675f76
add step for generating short_sha for filename
theBeginner86 Jan 9, 2022
e370a8f
Merge remote-tracking branch 'upstream/master' into minor-changes-e2e…
theBeginner86 Jan 9, 2022
9281b54
Merge pull request #149 from theBeginner86/minor-changes-e2etest
Revolyssup Jan 9, 2022
c81e97c
Add Ashish and Rudraksh in reviewers
Revolyssup Jan 10, 2022
9e21c00
Merge pull request #150 from Revolyssup/dep
Revolyssup Jan 10, 2022
091083a
Add build time and modify run time comp generation
Revolyssup Jan 19, 2022
690b8f2
Add build time and modify run time comp generation
Revolyssup Jan 19, 2022
b3ee972
Add build time and modify run time comp generation
Revolyssup Jan 19, 2022
82fdda2
Update go version
Revolyssup Jan 19, 2022
656d7f2
Minor changes
Revolyssup Jan 19, 2022
69f213d
fix security check
Revolyssup Jan 19, 2022
06abb62
Merge pull request #156 from Revolyssup/abc
leecalcote Jan 24, 2022
f4dc791
Bump github.com/layer5io/meshkit from 0.2.34 to 0.5.2
dependabot[bot] Jan 24, 2022
82d6c1d
[Patterns] Pattern components generated from latest Traefik manifests
leecalcote Jan 24, 2022
4ea6b14
Merge pull request #157 from meshery/dependabot/go_modules/github.com…
leecalcote Jan 24, 2022
b2b0d0b
Fix #159
Revolyssup Jan 25, 2022
d3418c6
Merge pull request #160 from Revolyssup/schemas
leecalcote Jan 25, 2022
5cff7b8
changed timestamp format for e2e test
asubedy Jan 30, 2022
9ca20a9
Merge pull request #162 from asubedy/timestamp-format
leecalcote Feb 2, 2022
a5d75c5
Make release URL as constant type
alphaX86 Jan 1, 2022
feeb046
Merge branch 'cwe88-fix' of https://github.com/alphaX86/meshery-traef…
alphaX86 Feb 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions internal/config/releases.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ type Asset struct {
// limited by the "limit" parameter. It filters out all the rc
// releases and sorts the result lexographically (descending)
func getLatestReleaseNames(limit int) ([]adapter.Version, error) {
releases, err := GetLatestReleases(10)
releases, err := GetLatestReleases()
if err != nil {
return []adapter.Version{}, ErrGetLatestReleaseNames(err)
}
Expand Down Expand Up @@ -63,8 +63,9 @@ func getLatestReleaseNames(limit int) ([]adapter.Version, error) {
}

// GetLatestReleases fetches the latest releases from the traefik mesh repository
func GetLatestReleases(releases uint) ([]*Release, error) {
releaseAPIURL := "https://api.github.com/repos/traefik/mesh/releases?per_page=" + fmt.Sprint(releases)
func GetLatestReleases() ([]*Release, error) {
// Making the results to 10 to avoid fetching lot of releases (to avoid CWE-88)
const releaseAPIURL = "https://api.github.com/repos/traefik/mesh/releases?per_page=10"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense.

@meshery/adapter-maintainers please take note.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This uses github API, I have added the page scraping way in meshkit. I think, that should be reused everywhere. We need to get off github API completely for fetching latest releases

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, very good point, @Revolyssup.

@manav1403 or @piyushsingariya might point out examples of where this has been done elsewhere, so that we can move entirely away from any api.github.com requests and over to github.com requests.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Never mind. I think @Revolyssup has this covered here - https://github.com/meshery/meshery/pull/4667/files/040346d6d219572aad6e1979b6cd0a00e0db083c..dd64b57cf7825d0094b4bc00a512f945fccfc942

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK... This makes sense, if that change is implemented I'll include the method here too

// We need a variable url here hence using nosec
// #nosec
resp, err := http.Get(releaseAPIURL)
Expand Down