Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • Knot Resolver Knot Resolver
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 144
    • Issues 144
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 14
    • Merge requests 14
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Knot projects
  • Knot ResolverKnot Resolver
  • Merge requests
  • !1291

Draft: manager: datamodel: secure use of strings in lua configuration

  • Review changes

  • Download
  • Email patches
  • Plain diff
Open Aleš Mrázek requested to merge manager-datamodel-security into manager Apr 27, 2022
  • Overview 7
  • Commits 18
  • Pipelines 21
  • Changes 22

Since we render the lua configuration with jinja2 template, all string inputs in configuration should be validated or escaped. No generic str type in configuration schema(except lua section).

  • new regex for IDPattern
  • There are two custom types for string inputs that cannot be strictly validated.
    • EscapedStr - escapes single/double quotes and newlines
    • RawStr - raw representation, escapes all unicode chars and quotes

A simple example of a problem with quotes and newlines:

hostname: "')\nany_lua_code"

Jinja2 template:

hostname('{cfg.hostname}')

Render:

hostname('')
any_lua_code

As a result, kresd startup fails or worse, any_lua_code may be executed.

Are there any other characters or something else I missed that can cause problems? cc @vcunat @ostava

related #715

Edited May 26, 2022 by Aleš Mrázek
Assignee
Assign to
Reviewers
Request review from
Time tracking
Source branch: manager-datamodel-security