server/v2auth: reject empty permission patterns - #22379
Conversation
simpleMatch and prefixMatch dereference pattern[len(pattern)-1] without checking whether the pattern is empty. An empty-string permission pattern can be stored through the v2 role API, and matching it then panics with "runtime error: index out of range [-1]", which drops the client request. Treat an empty pattern as non-matching so that a role carrying one is denied access gracefully instead of crashing the request handler. Signed-off-by: sunliqiang <sunliqiang@kylinos.cn>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Pyolar The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @Pyolar. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
1 participant
simpleMatchandprefixMatchin the v2 auth package dereferencepattern[len(pattern)-1]without checking whether the pattern is empty. An empty-string permission pattern can be stored through the v2 role API (no validation when the role is created or updated), and the next time a user whose role carries that pattern accesses a key, matching panics withruntime error: index out of range [-1]. The panic is recovered by net/http which then closes the connection, so the request is dropped without a response.Fix
Treat an empty pattern as non-matching in both
simpleMatchandprefixMatchso that roles containing an empty pattern are denied access gracefully instead of crashing the request handler.Test
Added
TestEmptyPatternDoesNotPaniccoveringHasKeyAccess,HasRecursiveAccess,simpleMatchandprefixMatchwith an empty pattern, plus a sanity check that the*wildcard still matches.