fix: assorted small validation and robustness fixes#2450
fix: assorted small validation and robustness fixes#2450andrewwhitecdw wants to merge 3 commits into
Conversation
validate_label_key and validate_label_value used Unicode-aware char::is_alphanumeric(), so values like 'café' or '日本語' passed gateway validation even though the Kubernetes label spec (([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])? is ASCII-only and the API server rejects such labels later. The same functions already validate the key prefix with ASCII-only checks. Use is_ascii_alphanumeric() and add regression tests for Unicode keys and values. Signed-off-by: Andrew White <andrewh@cdw.com>
Two display paths in sandbox policy commands sliced server-supplied strings without guarding: - sandbox_policy_set used &resp.policy_hash[..12] unconditionally; an empty or short proto3 hash field would panic. Use the existing short_hash() helper, as nearby call sites already do. - The policy revision table truncated load_error at a fixed byte index (&rev.load_error[..40]), panicking on multi-byte UTF-8 in server error messages. Back off to a char boundary instead. Signed-off-by: Andrew White <andrewh@cdw.com>
The IANA dynamic/private (ephemeral) port range is 49152-65535 inclusive, but the check used port > 49152, silently omitting the advisory note for port 49152 itself. Signed-off-by: Andrew White <andrewh@cdw.com>
|
I have read the DCO document and I hereby sign the DCO. |
|
All contributors have signed the DCO ✍️ ✅ |
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
Validation: This is project-valid small, concentrated robustness work. PR #2410 is the same author's auto-closed predecessor, not competing active work.
Head SHA: 949b5b6be5d0634296691cf826d0c81e4f48c7f1
Review findings:
- Two warning-level UTF-8 panic paths remain in CLI rendering; see the inline comments.
- Suggested coverage: exercise a multibyte
load_errorcrossing byte 40 and the ephemeral-port boundary at 49151/49152.
Docs: Fern docs and navigation are not needed because these fixes add no command, option, workflow, or documented contract.
Next state: gator:in-review; author changes are needed before pipeline/E2E gating.
| "·".dimmed(), | ||
| resp.version, | ||
| &resp.policy_hash[..12] | ||
| short_hash(&resp.policy_hash) |
There was a problem hiding this comment.
gator-agent
Warning: short_hash still uses &hash[..12], so a server response such as aaaaaaaaaaaé panics when byte 12 splits a UTF-8 character (CWE-248). Make short_hash select the twelfth character boundary using char_indices() and add short/multibyte regression cases; that fixes both new call sites.
| }; | ||
| let error_short = if rev.load_error.len() > 40 { | ||
| format!("{}...", &rev.load_error[..40]) | ||
| // Back off to a char boundary: byte-index slicing panics on |
There was a problem hiding this comment.
gator-agent
Warning: The revision table still byte-slices the server-supplied policy hash, preserving the same UTF-8 panic (CWE-248). After fixing short_hash, replace this branch with let hash_short = short_hash(&rev.policy_hash);.
johntmyers
added
the
gator:in-review
2 participants
Summary
Three small, independent robustness fixes found during code review, one commit each:
is_alphanumeric(), so labels likecaféor日本語passed gateway validation but would be rejected by the Kubernetes API server (the label spec is ASCII-only). The same functions already validate the key prefix with ASCII-only checks.print_policy_revision_tabletruncated server-suppliedload_errorstrings at a fixed byte index (&rev.load_error[..40]), panicking when the index lands inside a multi-byte UTF-8 character (same bug class as fix(cli): avoid panic on multi-byte UTF-8 in --since duration #2446).port > 49152, omitting port 49152 itself from the IANA dynamic/private range (49152–65535 inclusive).This PR supersedes #2410, which was auto-closed by the vouch-check workflow before I was vouched.
Related Issue
N/A — small fixes found during code review.
Changes
validate_label_key/validate_label_value: useis_ascii_alphanumeric(); added Unicode rejection testsprint_policy_revision_table: back off to a char boundary when truncatingload_errormechanistic_mapper:port >= 49152for the ephemeral range noteTesting
mise run pre-commitpasses (mise unavailable in this environment; ran equivalentcargo fmt+cargo clippyon all touched crates — clean)cargo test -p openshell-server validate_label— 40 passed, incl. 2 new)Checklist