Added validation for parameters with bracket notation #4833

chitrangpatel · 2022-05-04T16:09:26Z

Added validation for parameters with bracket notation.

Prior to this, when supplied parameter name was not the same as that
called in the step, webhook raised an error when using the dot notation
as expected. However, it did not when using the bracket notation.

Changes

Updated the unit tests to also check for valid bracket notations.
This PR addresses issue #4787

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Docs included if any changes are user facing
Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including
functionality, content, code)
Release notes block below has been filled in
(if there are no user facing changes, use release note "NONE")

Release Notes

Added validation for parameters with bracket notation

tekton-robot · 2022-05-04T16:09:43Z

Hi @chitrangpatel. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2022-05-04T17:19:35Z

@chitrangpatel: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

chuangw6 · 2022-05-04T19:16:15Z

pkg/substitution/substitution.go

+		for _, v := range vs {
+			v = strings.TrimSuffix(v, "[*]")
+
+			// contains any character except "_a-zA-Z0-9.-"?
+			re := regexp.MustCompile(`[^_a-zA-Z0-9.-]`)
+			matches := re.FindAllStringSubmatch(v, -1)
+			if len(matches) > 0 {
+				return &apis.FieldError{
+					Message: fmt.Sprintf("Invalid variable name format in value: %q. Must not contain any character other than a-z, A-Z, 0-9, or . _  -", value),
+					// Empty path is required to make the `ViaField`, … work
+					Paths: []string{""},
+				}
+			}
+
+			// starts with anything except _, a-z, A-Z?
+			re = regexp.MustCompile(`^[^_a-zA-Z].*`)
+			matches = re.FindAllStringSubmatch(v, -1)
+			if len(matches) > 0 {
+				return &apis.FieldError{
+					Message: fmt.Sprintf("Invalid variable name format in value: %q. Must not start with any character other than a-z, A-Z, 0-9, or _", value),
+					// Empty path is required to make the `ViaField`, … work
+					Paths: []string{""},
+				}
+			}
+		}
+	}


Based on the three steps we discussed (pasted below), in step2, I think we don't need to do any validation here inside ValidateVariableP. Because validation against the param names specified in ParamSpec should happen inside task_validation.go's validateVariables function, which is step 1.

Step1: validate the format of param names at the beginning of validateVariables in pkg/apis/pipeline/v1beta1/task_validation.go (Implemented here #4799)

Step2: change regex to extract NAME for $(params.<NAME>) and NAME for $(params["<NAME>"]) without validating anything

Step3: Check if the extracted string is one of the param names declared in param spec. (exists already)

Should be ok now @chuangw6 . Let me know otherwise.

afrittoli · 2022-05-04T19:42:29Z

/ok-to-test

afrittoli · 2022-05-04T19:43:45Z

Release Notes
NONE

Perhaps its worth adding a note in the release notes?

tekton-robot · 2022-05-04T19:45:10Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/substitution/substitution.go	43.8%	65.0%	21.2

tekton-robot · 2022-05-04T21:14:26Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/substitution/substitution.go	43.8%	54.5%	10.7

chitrangpatel · 2022-05-04T21:15:37Z

Release Notes
NONE
Perhaps its worth adding a note in the release notes?

@afrittoli Since there were no user facing changes, I skipped it as suggested by the Submitter Checklist section. I added one now anyway 🙂

chitrangpatel · 2022-05-04T21:39:23Z

/retest

tekton-robot · 2022-05-05T08:40:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lbernick · 2022-05-05T18:02:24Z

@chitrangpatel would you mind changing the PR title to something more descriptive?
In addition, a more informative release note could be something like "Added validation for parameters with bracket notation"

chitrangpatel · 2022-05-05T18:42:47Z

@chitrangpatel would you mind changing the PR title to something more descriptive?
In addition, a more informative release note could be something like "Added validation for parameters with bracket notation"

Done!

lbernick · 2022-05-09T13:22:23Z

@chitrangpatel would you mind also changing the commit message title and PR title to be "Add validation for parameters with bracket notation"? other than that looks good :)

chitrangpatel · 2022-05-09T13:24:09Z

@chitrangpatel would you mind also changing the commit message title and PR title to be "Add validation for parameters with bracket notation"? other than that looks good :)

Done!

lbernick · 2022-05-09T13:32:41Z

@chitrangpatel would you mind also changing the commit message title and PR title to be "Add validation for parameters with bracket notation"? other than that looks good :)

Done!

don't forget the commit message title!

Prior to this, when supplied parameter name was not the same as that called in the step, webhook raised an error when using the dot notation as expected. However, it did not when using the bracket notation. Updated the unit tests to also check for valid bracket notations.

chitrangpatel · 2022-05-09T13:46:09Z

@chitrangpatel would you mind also changing the commit message title and PR title to be "Add validation for parameters with bracket notation"? other than that looks good :)

Done!

don't forget the commit message title!

Done now. (I accidentally changed the PR's first line thinking it was the title of the commit message).

tekton-robot · 2022-05-09T13:48:59Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/substitution/substitution.go	43.8%	54.5%	10.7

chitrangpatel · 2022-05-09T14:48:33Z

/retest

lbernick · 2022-05-09T15:04:38Z

/lgtm

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label May 4, 2022

tekton-robot requested review from bobcatfish and dlorenc May 4, 2022 16:09

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 4, 2022

chitrangpatel closed this May 4, 2022

chitrangpatel reopened this May 4, 2022

chitrangpatel marked this pull request as draft May 4, 2022 16:47

chitrangpatel force-pushed the issue-4787 branch from 65da44d to 08eafc3 Compare May 4, 2022 17:03

tekton-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 4, 2022

chitrangpatel force-pushed the issue-4787 branch from 08eafc3 to c75a96f Compare May 4, 2022 17:17

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 4, 2022

chitrangpatel marked this pull request as ready for review May 4, 2022 17:18

tekton-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 4, 2022

chuangw6 reviewed May 4, 2022

View reviewed changes

tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 4, 2022

chitrangpatel force-pushed the issue-4787 branch from c75a96f to 6161681 Compare May 4, 2022 21:11

vdemeester approved these changes May 5, 2022

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 5, 2022

chitrangpatel changed the title ~~Issue 4787~~ Issue-4787-Missing-validation-when-referencing-unknown-params-with-bracket-notation May 5, 2022

chuangw6 mentioned this pull request May 6, 2022

Validate parameter name format #4799

Merged

5 tasks

chitrangpatel changed the title ~~Issue-4787-Missing-validation-when-referencing-unknown-params-with-bracket-notation~~ Added validation for parameters with bracket notation May 9, 2022

chitrangpatel force-pushed the issue-4787 branch from 6161681 to 01513a4 Compare May 9, 2022 13:45

tekton-robot assigned lbernick May 9, 2022

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label May 9, 2022

tekton-robot merged commit e586418 into tektoncd:main May 9, 2022

imjasonh mentioned this pull request May 14, 2022

Missing validation when referencing unknown params with bracket notation #4787

Closed

bradbeck mentioned this pull request Jun 9, 2022

Updated Tekton Pipeline to v0.36.0 buildsec/frsca#237

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added validation for parameters with bracket notation #4833

Added validation for parameters with bracket notation #4833

chitrangpatel commented May 4, 2022 •

edited

tekton-robot commented May 4, 2022

tekton-robot commented May 4, 2022

chuangw6 May 4, 2022 •

edited

chitrangpatel May 4, 2022

afrittoli commented May 4, 2022

afrittoli commented May 4, 2022

Release Notes

tekton-robot commented May 4, 2022

tekton-robot commented May 4, 2022

chitrangpatel commented May 4, 2022 •

edited

Release Notes

chitrangpatel commented May 4, 2022

tekton-robot commented May 5, 2022

lbernick commented May 5, 2022

chitrangpatel commented May 5, 2022

lbernick commented May 9, 2022

chitrangpatel commented May 9, 2022

lbernick commented May 9, 2022

chitrangpatel commented May 9, 2022

tekton-robot commented May 9, 2022

chitrangpatel commented May 9, 2022

lbernick commented May 9, 2022

Added validation for parameters with bracket notation #4833

Added validation for parameters with bracket notation #4833

Conversation

chitrangpatel commented May 4, 2022 • edited

Changes

Submitter Checklist

Release Notes

tekton-robot commented May 4, 2022

tekton-robot commented May 4, 2022

chuangw6 May 4, 2022 • edited

Choose a reason for hiding this comment

chitrangpatel May 4, 2022

Choose a reason for hiding this comment

afrittoli commented May 4, 2022

afrittoli commented May 4, 2022

Release Notes

tekton-robot commented May 4, 2022

tekton-robot commented May 4, 2022

chitrangpatel commented May 4, 2022 • edited

Release Notes

chitrangpatel commented May 4, 2022

tekton-robot commented May 5, 2022

lbernick commented May 5, 2022

chitrangpatel commented May 5, 2022

lbernick commented May 9, 2022

chitrangpatel commented May 9, 2022

lbernick commented May 9, 2022

chitrangpatel commented May 9, 2022

tekton-robot commented May 9, 2022

chitrangpatel commented May 9, 2022

lbernick commented May 9, 2022

chitrangpatel commented May 4, 2022 •

edited

chuangw6 May 4, 2022 •

edited

chitrangpatel commented May 4, 2022 •

edited