Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Webhook: Azure git repo urls fail to match #9055

Closed
AlexGS74 opened this issue Apr 9, 2022 · 1 comment · Fixed by #12203
Closed

Webhook: Azure git repo urls fail to match #9055

AlexGS74 opened this issue Apr 9, 2022 · 1 comment · Fixed by #12203
Labels
bug Something isn't working

Comments

@AlexGS74
Copy link

AlexGS74 commented Apr 9, 2022

To trigger argocd updates on git push I have a hook setup to mimic GitHub push events. It gets accepted by Argo but it fails to match the repos defined in Argo.

"https://tenant-name@dev.azure.com/tenant-name/ProjectName/_git/GitOps does not match (?i)^(http://|https://|\\w+@|ssh://(\\w+@)?)dev\\.azure\\.com(:[0-9]+|)[:/]tenant-name/ProjectName/_git/GitOps(\\.git)?$"

The generated regex has a few issues with the Azure specific Urls:

  • the tenant name has a dash in it but the matching group is (\w+@)? while it should be ([\w-]+)?
  • the same group is generated inside of the group with series of one-of matches and that makes it never match for urls starting with http and https prefixes; the fix would be to move it outside like here: (?i)^(http://|https://|\\w+@|ssh://)(\\w+@)?dev\\.azure\\.com(:[0-9]+|)[:/]tenant-name/ProjectName/_git/GitOps(\\.git)?$

As alternative I tried to use Ssh url and the same generated regexp has issue with ssh matches too:

"git@ssh.dev.azure.com:v3/tenant-name/ProjectName/GitOps does not match (?i)^(http://|https://|\\w+@|ssh://(\\w+@)?)ssh\\.dev\\.azure\\.com(:[0-9]+|)[:/]tenant-name/ProjectName/GitOps(\\.git)?$"

The issue here is that the regexp expects the ssh to follow uri format which it doesn't:

  • the (:[0-9]+|) group doesn't match :v3 which in the case of ssh is not a port but a part of the path; this can be fixed by (:[0-9a-zA-Z]+|) or (:\w+|)

To Reproduce

Enable debug level logging in the argocd-server app and use the command below to test the bahaviour:

curl https://example.argocd/argocd/api/webhook -k -H 'X-GitHub-Event: push' -d '{
  "ref": "refs/heads/release/ci", \
  "repository": { \
    "html_url": "https://tenant-name@dev.azure.com/tenant-name/ProjectName/_git/GitOps", \
    "default_branch": "refs/heads/main" \
  }, \
  "commits": [ \
    { \
      "modified": [ "/pipelines/trigger-argocd-refresh.yml" ] \ 
    } \ 
  ] \ 
}' \

Expected behavior

The regexps should match above cases.

Version

> argocd version
argocd: v2.1.3+d855831.dirty
  BuildDate: 2021-09-30T22:11:24Z
  GitCommit: d855831540e51d8a90b1006d2eb9f49ab1b088af
  GitTreeState: dirty
  GoVersion: go1.17.1
  Compiler: gc
  Platform: darwin/amd64
argocd-server: v2.3.3+07ac038
@AlexGS74 AlexGS74 added the bug Something isn't working label Apr 9, 2022
@olljanat
Copy link

To trigger argocd updates on git push I have a hook setup to mimic GitHub push events. It gets accepted by Argo...

Interesting idea. Can you please share how you do it on #3937

crenshaw-dev pushed a commit that referenced this issue Feb 17, 2023
This commit fixes incorrect regular expression used for URL matching.

Expected behavior: valid user info part is matched => webhook is sent.
Actual behavior: some valid user info is not matched, example: `ssh://user-name@example.com/org/repo` => webhook is not sent.

Context:
 - [RFC 3986 3.2.1 - User Information](https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1)
 - [Username validation regex in shadow Linux package](https://github.com/shadow-maint/shadow/blob/master/libmisc/chkname.c#L36)

Signed-off-by: mdsjip <2284562+mdsjip@users.noreply.github.com>
crenshaw-dev pushed a commit that referenced this issue Feb 17, 2023
This commit fixes incorrect regular expression used for URL matching.

Expected behavior: valid user info part is matched => webhook is sent.
Actual behavior: some valid user info is not matched, example: `ssh://user-name@example.com/org/repo` => webhook is not sent.

Context:
 - [RFC 3986 3.2.1 - User Information](https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1)
 - [Username validation regex in shadow Linux package](https://github.com/shadow-maint/shadow/blob/master/libmisc/chkname.c#L36)

Signed-off-by: mdsjip <2284562+mdsjip@users.noreply.github.com>
crenshaw-dev pushed a commit that referenced this issue Feb 17, 2023
This commit fixes incorrect regular expression used for URL matching.

Expected behavior: valid user info part is matched => webhook is sent.
Actual behavior: some valid user info is not matched, example: `ssh://user-name@example.com/org/repo` => webhook is not sent.

Context:
 - [RFC 3986 3.2.1 - User Information](https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1)
 - [Username validation regex in shadow Linux package](https://github.com/shadow-maint/shadow/blob/master/libmisc/chkname.c#L36)

Signed-off-by: mdsjip <2284562+mdsjip@users.noreply.github.com>
crenshaw-dev pushed a commit that referenced this issue Feb 17, 2023
This commit fixes incorrect regular expression used for URL matching.

Expected behavior: valid user info part is matched => webhook is sent.
Actual behavior: some valid user info is not matched, example: `ssh://user-name@example.com/org/repo` => webhook is not sent.

Context:
 - [RFC 3986 3.2.1 - User Information](https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1)
 - [Username validation regex in shadow Linux package](https://github.com/shadow-maint/shadow/blob/master/libmisc/chkname.c#L36)

Signed-off-by: mdsjip <2284562+mdsjip@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants