Skip to content

[Issue-1119] Adds additional validation that --git-url does not contain the repository path #329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chenbh merged 1 commit into from
Sep 8, 2023
Merged

[Issue-1119] Adds additional validation that --git-url does not contain the repository path #329

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions pkg/secret/factory.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,13 @@ package secret

import (
"encoding/json"
"github.com/google/go-containerregistry/pkg/name"
"os"
"regexp"
"sort"
"strings"

"github.com/google/go-containerregistry/pkg/name"

"github.com/google/go-containerregistry/pkg/authn"
"github.com/pkg/errors"
corev1 "k8s.io/api/core/v1"
Expand All @@ -23,6 +25,9 @@ const (
GitAnnotation = "kpack.io/git"
)

var gitHttpUrlRegex = regexp.MustCompile(`^(?:https?://)?(?:[a-zA-Z0-9\-\.])+\.(?:\w+)(:(?:\d){3,5})?$`)
var gitSshRegex = regexp.MustCompile(`^((?:ssh://)?(?:[A-Za-z0-9])+@(?:[A-Za-z0-9+.-])+\.(?:\w+)(:(?:\d){3,5})?)$|^(?:[A-Za-z0-9][A-Za-z0-9+.-]+)\.(?:[A-Za-z0-9]+)$`)

type CredentialFetcher interface {
FetchPassword(envVar, prompt string) (string, error)
}
Expand Down Expand Up @@ -105,11 +110,11 @@ func (f *Factory) validate() error {
}
}

if f.GitUser != "" && !(strings.HasPrefix(f.GitUrl, "http://") || strings.HasPrefix(f.GitUrl, "https://")) {
return errors.Errorf("must provide a valid git url for basic auth (ex. https://github.com)")
if f.GitUser != "" && !gitHttpUrlRegex.MatchString(f.GitUrl) {
return errors.Errorf("must provide a valid git url without the repository path for basic auth (ex. https://github.com)")
}

if f.GitSshKeyFile != "" && !strings.HasPrefix(f.GitUrl, "git@") {
if f.GitSshKeyFile != "" && !gitSshRegex.MatchString(f.GitUrl) {
return errors.Errorf("must provide a valid git url for SSH (ex. git@github.com)")
}

Expand Down
109 changes: 87 additions & 22 deletions pkg/secret/factory_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
package secret_test

import (
"fmt"
"testing"

"github.com/sclevine/spec"
Expand Down Expand Up @@ -99,23 +100,19 @@ func testSecretFactory(t *testing.T, when spec.G, it spec.S) {

when("sub params are mixed with git", func() {
it("returns an error message", func() {
it("returns an error message", func() {
factory.GitUrl = "some-git"
factory.RegistryUser = "some-reg-user"
factory.GitUser = "some-git-user"
_, _, err := factory.MakeSecret("test-name", "test-namespace")
require.EqualError(t, err, "extraneous parameters: registry-user")
})
factory.GitUrl = "some-git"
factory.RegistryUser = "some-reg-user"
factory.GitUser = "some-git-user"
_, _, err := factory.MakeSecret("test-name", "test-namespace")
require.EqualError(t, err, "extraneous parameters: registry-user")
})
})

when("neither git basic auth nor git ssh are provided", func() {
it("returns an error message", func() {
it("returns an error message", func() {
factory.GitUrl = "some-git"
_, _, err := factory.MakeSecret("test-name", "test-namespace")
require.EqualError(t, err, "missing parameter git-user or git-ssh-key")
})
factory.GitUrl = "some-git"
_, _, err := factory.MakeSecret("test-name", "test-namespace")
require.EqualError(t, err, "missing parameter git-user or git-ssh-key")
})
})

Expand All @@ -130,20 +127,88 @@ func testSecretFactory(t *testing.T, when spec.G, it spec.S) {
})

when("using git basic auth", func() {
it("validates that the git url begins with http:// or https://", func() {
factory.GitUrl = "some-git"
factory.GitUser = "some-git-user"
_, _, err := factory.MakeSecret("test-name", "test-namespace")
require.EqualError(t, err, "must provide a valid git url for basic auth (ex. https://github.com)")
it("validates that the git url is correct", func() {
validGitUrls := []string{
"https://github.com",
"http://github.com",
"https://github.enterprise:1234",
"http://github.enterprise:134",
"https://domain.com",
"http://domain.com",
"github.com",
"bitbucket.org",
}
for _, testUrl := range validGitUrls {
factory.GitUrl = testUrl
factory.GitUser = "some-git-user"
s, _, err := factory.MakeSecret("test-name", "test-namespace")
require.NotNilf(t, s, "factory.GitUrl = \"%s\" secret should not be nil", factory.GitUrl)
require.NoError(t, err, fmt.Sprintf("factory.GitUrl = \"%s\" should not have errors", factory.GitUrl))
}
})

it("validates that the git url is correct", func() {
invalidGitUrls := []string{
"some-git",
"https://some-git.com/test",
"https://some-git.com/",
"https://domain.com/stash/csm/blabla/project.git",
"http://github.enterprise:13444456",
}
for _, testUrl := range invalidGitUrls {
factory.GitUrl = testUrl
factory.GitUser = "some-git-user"
s, _, err := factory.MakeSecret("test-name", "test-namespace")
require.Nilf(t, s, "factory.GitUrl = \"%s\" secret should be nil", factory.GitUrl)
require.EqualError(t, err, "must provide a valid git url without the repository path for basic auth (ex. https://github.com)")
}
})
})

when("using git ssh keys", func() {
it("validates that the git url begins with git@", func() {
factory.GitUrl = "some-git"
factory.GitSshKeyFile = "some-ssh-key"
_, _, err := factory.MakeSecret("test-name", "test-namespace")
require.EqualError(t, err, "must provide a valid git url for SSH (ex. git@github.com)")
it("creates a secret when a valid ssh git url is passed", func() {
validGitSshUrls := []string{
"git@github.com",
"user@domain.com",
"test@github.com",
"domain.com",
"ssh://git@github.com:123",
"ssh://git@github.com",
}
for _, testUrl := range validGitSshUrls {
factory.GitUrl = testUrl
factory.GitSshKeyFile = "./testdata/some-ssh-key.pem"
s, _, err := factory.MakeSecret("test-name", "test-namespace")
require.NotNilf(t, s, "factory.GitUrl = \"%s\" secret should not be nil", factory.GitUrl)
require.NoError(t, err, fmt.Sprintf("factory.GitUrl = \"%s\" should not have errors", factory.GitUrl))
}
})

it("prints an error when the git url is not valid", func() {
invalidGitSshUrls := []string{
"some-git",
"git@github.com:owner",
"git@github.com:owner/repo",
"git@github.com:443/user/repo.git",
"git@github.com:user/repo.git",
"git@github.com:buildpacks-community/kpack-cli.git",
"ssh://git@ssh.github.com:443/YOUR-USERNAME/YOUR-REPOSITORY.git",
"git@github.com/abc.git",
"git@github.com:user/repo.git",
"ssh://git@example.com/path/to/repo.git",
"ssh://user@bitbucket.org/group/my-repo.git",
"git@custom-git-server.local:myrepo.git",
"git@gitlab.com:username/project.git",
"git@github.com:44335678",
}
for _, testUrl := range invalidGitSshUrls {
factory.GitUrl = testUrl
factory.GitUrl = "some-git"
factory.GitSshKeyFile = "./testdata/some-ssh-key.pem"
s, _, err := factory.MakeSecret("test-name", "test-namespace")
require.Nilf(t, s, "factory.GitUrl = \"%s\" secret should be nil", factory.GitUrl)
require.EqualError(t, err, "must provide a valid git url for SSH (ex. git@github.com)")
}
})
})
}
Expand Down
Empty file added pkg/secret/testdata/some-ssh-key.pem
View file
Open in desktop
Empty file.