Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace ddmark with go-validator #944

Draft
wants to merge 2 commits into
base: philip/chaosplt-68
Choose a base branch
from
Draft

Replace ddmark with go-validator #944

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d508dea
Try using go-validator instead of ddmark
ptnapoleon Dec 16, 2024
812a687
Use go-validator in DisruptionSpec's Validate func
ptnapoleon Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions LICENSE-3rdparty.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,6 +213,10 @@ github.com/evanphx/json-patch/v5,github.com/evanphx/json-patch/v5,BSD-3-Clause
github.com/evanphx/json-patch/v5,github.com/evanphx/json-patch/v5/internal/json,BSD-3-Clause
github.com/felixge/httpsnoop,github.com/felixge/httpsnoop,MIT
github.com/fsnotify/fsnotify,github.com/fsnotify/fsnotify,BSD-3-Clause
github.com/gabriel-vasile/mimetype,github.com/gabriel-vasile/mimetype,MIT
github.com/gabriel-vasile/mimetype,github.com/gabriel-vasile/mimetype/internal/charset,MIT
github.com/gabriel-vasile/mimetype,github.com/gabriel-vasile/mimetype/internal/json,MIT
github.com/gabriel-vasile/mimetype,github.com/gabriel-vasile/mimetype/internal/magic,MIT
github.com/go-logr/logr,github.com/go-logr/logr,Apache-2.0
github.com/go-logr/logr,github.com/go-logr/logr/funcr,Apache-2.0
github.com/go-logr/logr,github.com/go-logr/logr/slogr,Apache-2.0
Expand All @@ -224,6 +228,10 @@ github.com/go-openapi/jsonpointer,github.com/go-openapi/jsonpointer,Apache-2.0
github.com/go-openapi/jsonreference,github.com/go-openapi/jsonreference,Apache-2.0
github.com/go-openapi/jsonreference,github.com/go-openapi/jsonreference/internal,Apache-2.0
github.com/go-openapi/swag,github.com/go-openapi/swag,Apache-2.0
github.com/go-playground/locales,github.com/go-playground/locales,MIT
github.com/go-playground/locales,github.com/go-playground/locales/currency,MIT
github.com/go-playground/universal-translator,github.com/go-playground/universal-translator,MIT
github.com/go-playground/validator/v10,github.com/go-playground/validator/v10,MIT
github.com/go-task/slim-sprig,github.com/go-task/slim-sprig,MIT
github.com/godbus/dbus/v5,github.com/godbus/dbus/v5,BSD-2-Clause
github.com/gogo/googleapis,github.com/gogo/googleapis/google/rpc,Apache-2.0
Expand Down Expand Up @@ -281,6 +289,8 @@ github.com/klauspost/compress,github.com/klauspost/compress/internal/cpuinfo,Apa
github.com/klauspost/compress,github.com/klauspost/compress/internal/snapref,Apache-2.0
github.com/klauspost/compress,github.com/klauspost/compress/zstd,Apache-2.0
github.com/klauspost/compress,github.com/klauspost/compress/zstd/internal/xxhash,Apache-2.0
github.com/leodido/go-urn,github.com/leodido/go-urn,MIT
github.com/leodido/go-urn,github.com/leodido/go-urn/scim/schema,MIT
github.com/liggitt/tabwriter,github.com/liggitt/tabwriter,BSD-3-Clause
github.com/lufia/plan9stats,github.com/lufia/plan9stats,BSD-3-Clause
github.com/magiconair/properties,github.com/magiconair/properties,BSD-2-Clause
Expand Down Expand Up @@ -486,6 +496,7 @@ go.uber.org/zap,go.uber.org/zap/internal/ztest,MIT
go.uber.org/zap,go.uber.org/zap/zapcore,MIT
go.uber.org/zap,go.uber.org/zap/zaptest,MIT
go.uber.org/zap,go.uber.org/zap/zaptest/observer,MIT
golang.org/x/crypto,golang.org/x/crypto/sha3,BSD-3-Clause
golang.org/x/exp,golang.org/x/exp/maps,BSD-3-Clause
golang.org/x/mod,golang.org/x/mod/semver,BSD-3-Clause
golang.org/x/net,golang.org/x/net/bpf,BSD-3-Clause
Expand All @@ -510,6 +521,7 @@ golang.org/x/oauth2,golang.org/x/oauth2,BSD-3-Clause
golang.org/x/oauth2,golang.org/x/oauth2/internal,BSD-3-Clause
golang.org/x/sync,golang.org/x/sync/errgroup,BSD-3-Clause
golang.org/x/sync,golang.org/x/sync/semaphore,BSD-3-Clause
golang.org/x/sys,golang.org/x/sys/cpu,BSD-3-Clause
golang.org/x/sys,golang.org/x/sys/execabs,BSD-3-Clause
golang.org/x/sys,golang.org/x/sys/plan9,BSD-3-Clause
golang.org/x/sys,golang.org/x/sys/unix,BSD-3-Clause
Expand Down
4 changes: 4 additions & 0 deletions api/v1beta1/disruption_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -586,6 +586,10 @@ func (s DisruptionSpec) ValidateSelectorsOptional(requireSelectors bool) (retErr
}
}

if err := ValidateStructTags(s); err != nil {
retErr = multierror.Append(retErr, err)
}

return multierror.Prefix(retErr, "Spec:")
}

Expand Down
14 changes: 7 additions & 7 deletions api/v1beta1/network_disruption.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,25 +68,25 @@ type NetworkDisruptionSpec struct {
Cloud *NetworkDisruptionCloudSpec `json:"cloud,omitempty"`
// +kubebuilder:validation:Minimum=0
// +kubebuilder:validation:Maximum=100
Drop int `json:"drop,omitempty"`
Drop int `json:"drop,omitempty" validate:"gte=0,lte=100"`
// +kubebuilder:validation:Minimum=0
// +kubebuilder:validation:Maximum=100
Duplicate int `json:"duplicate,omitempty"`
Duplicate int `json:"duplicate,omitempty" validate:"gte=0,lte=100"`
// +kubebuilder:validation:Minimum=0
// +kubebuilder:validation:Maximum=100
Corrupt int `json:"corrupt,omitempty"`
Corrupt int `json:"corrupt,omitempty" validate:"gte=0,lte=100"`
// +kubebuilder:validation:Minimum=0
// +kubebuilder:validation:Maximum=60000
Delay uint `json:"delay,omitempty"`
Delay uint `json:"delay,omitempty" validate:"gte=0,lte=60000"`
// +kubebuilder:validation:Minimum=0
// +kubebuilder:validation:Maximum=100
DelayJitter uint `json:"delayJitter,omitempty"`
DelayJitter uint `json:"delayJitter,omitempty" validate:"gte=0,lte=100"`
// +kubebuilder:validation:Minimum=0
BandwidthLimit int `json:"bandwidthLimit,omitempty"`
BandwidthLimit int `json:"bandwidthLimit,omitempty" validate:"gte=0"`
// +kubebuilder:validation:Minimum=0
// +kubebuilder:validation:Maximum=65535
// +nullable
DeprecatedPort *int `json:"port,omitempty"`
DeprecatedPort *int `json:"port,omitempty" validate:"gte=0,lte=65535"`
// +kubebuilder:validation:Enum=egress;ingress
DeprecatedFlow string `json:"flow,omitempty"`
// +nullable
Expand Down
95 changes: 95 additions & 0 deletions api/v1beta1/validations.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,15 @@ package v1beta1

import (
"context"
"errors"
"fmt"
"strconv"
"strings"

"github.com/go-playground/locales/en"
ut "github.com/go-playground/universal-translator"
"github.com/go-playground/validator/v10"
"github.com/hashicorp/go-multierror"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
Expand Down Expand Up @@ -118,6 +123,96 @@ func ValidateCount(count *intstr.IntOrString) error {
return nil
}

func newGoValidator() (*validator.Validate, ut.Translator, error) {
validate := validator.New()

englishLocale := en.New()
uni := ut.New(englishLocale, englishLocale)

translator, _ := uni.GetTranslator("en")

validate = validator.New()

if err := validate.RegisterTranslation("required", translator, func(ut ut.Translator) error {
return ut.Add("required", "{0} is a required field, and must be set", true)
}, func(ut ut.Translator, fe validator.FieldError) string {
t, _ := ut.T("required", fe.Field())

return t
}); err != nil {
return nil, nil, err
}

if err := validate.RegisterTranslation("gte", translator, func(ut ut.Translator) error {
return ut.Add("gte", "{0} is set to {1}, but must be greater or equal to {2}", true)
}, func(ut ut.Translator, fe validator.FieldError) string {
i := fe.Value().(*int)
var iStr string
if i != nil {
iStr = strconv.Itoa(*i)
} else {
iStr = "0"
}
t, _ := ut.T("gte", fe.Namespace(), fe.Param(), iStr)

return t
}); err != nil {
return nil, nil, err
}

if err := validate.RegisterTranslation("tle", translator, func(ut ut.Translator) error {
return ut.Add("lte", "{0} is set to {1}, but must be less or equal to {2}", true)
}, func(ut ut.Translator, fe validator.FieldError) string {
i := fe.Value().(*int)
var iStr string
if i != nil {
iStr = strconv.Itoa(*i)
} else {
iStr = "0"
}
t, _ := ut.T("lte", fe.Namespace(), fe.Param(), iStr)

return t
}); err != nil {
return nil, nil, err
}

return validate, translator, nil
}

func ValidateStructTags(s DisruptionSpec) error {
var retErr *multierror.Error

validate, translator, err := newGoValidator()
if err != nil {
return fmt.Errorf("could not validate struct tags: %w", err)
}

err = validate.Struct(s)

if err != nil {
// this check is only needed when your code could produce
// an invalid value for validation such as interface with nil
// value most including myself do not usually have code like this.
var invalidValidationError *validator.InvalidValidationError
if errors.As(err, &invalidValidationError) {
return err
}

for _, err := range err.(validator.ValidationErrors) {
retErr = multierror.Append(retErr,
multierror.Prefix(errors.New(err.Translate(translator)), "validate:"),
)
}
}

if retErr != nil {
return retErr.ErrorOrNil()
}

return nil
}

// IsUpdateConflictError tells us if this error is of the forms:
// "Operation cannot be fulfilled on disruptions.chaos.datadoghq.com "chaos-network-drop": the object has been modified; please apply your changes to the latest version and try again"
// "Operation cannot be fulfilled on disruptions.chaos.datadoghq.com "name": StorageError: invalid object, Code: 4, Key: /registry/chaos.datadoghq.com/disruptions/namespace/name, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3534199c-2597-443e-ae59-92e003310d64, UID in object meta:"
Expand Down
1 change: 1 addition & 0 deletions cli/chaosli/cmd/validate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"fmt"

"github.com/DataDog/chaos-controller/api/v1beta1"

"github.com/spf13/cobra"
)

Expand Down
6 changes: 6 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ require (
github.com/fsnotify/fsnotify v1.7.0
github.com/go-logr/logr v1.4.2
github.com/go-logr/zapr v1.3.0
github.com/go-playground/locales v0.14.1
github.com/go-playground/universal-translator v0.18.1
github.com/go-playground/validator/v10 v10.23.0
github.com/google/uuid v1.6.0
github.com/hashicorp/go-multierror v1.1.1
github.com/miekg/dns v1.1.55
Expand Down Expand Up @@ -63,11 +66,13 @@ require (
github.com/eapache/queue/v2 v2.0.0-20230407133247-75960ed334e4 // indirect
github.com/ebitengine/purego v0.6.0-alpha.5 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 // indirect
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/lufia/plan9stats v0.0.0-20220913051719-115f729f3c8c // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/sys/signal v0.6.0 // indirect
Expand All @@ -89,6 +94,7 @@ require (
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.29.0 // indirect
go.opentelemetry.io/otel/sdk v1.29.0 // indirect
golang.org/x/crypto v0.26.0 // indirect
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚫ Library Vulnerability

golang.org/x/crypto → 0.26.0

Suggested change
golang.org/x/crypto v0.26.0 // indirect
golang.org/x/crypto vv0.31.0// indirect
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (...read more)

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/[email protected] enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

View in Datadog  Leave us feedback  Documentation

golang.org/x/exp v0.0.0-20240318143956-a85f2c67cd81 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240822170219-fc7c04adadcd // indirect
)
Expand Down
12 changes: 12 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,6 +387,8 @@ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
Expand Down Expand Up @@ -426,6 +428,14 @@ github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh
github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
github.com/go-playground/validator/v10 v10.23.0 h1:/PwmTwZhS0dPkav3cdK9kV1FsAmrL8sThn8IHr/sO+o=
github.com/go-playground/validator/v10 v10.23.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
Expand Down Expand Up @@ -628,6 +638,8 @@ github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
Expand Down
1 change: 1 addition & 0 deletions vendor/github.com/gabriel-vasile/mimetype/.gitattributes
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

76 changes: 76 additions & 0 deletions vendor/github.com/gabriel-vasile/mimetype/CODE_OF_CONDUCT.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions vendor/github.com/gabriel-vasile/mimetype/CONTRIBUTING.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

21 changes: 21 additions & 0 deletions vendor/github.com/gabriel-vasile/mimetype/LICENSE
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading