fix: Make dry-run=server optional #499
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Closed
yxxhero
reviewed
Oct 11, 2023
cmd/upgrade.go
Outdated
| @@ -67,6 +69,11 @@ func (d *diffCmd) isAllowUnreleased() bool { | |||
| return d.allowUnreleased || d.install | |||
| } | |||
|
|
|||
| func (d *diffCmd) isRemoteAccessAllowed() bool { | |||
There was a problem hiding this comment.
adding some unit tests will be better.
There was a problem hiding this comment.
@yxxhero Are you saying we should have a unit test for checking all the combinations of variables involved in L73?
Merged
mumoshu
force-pushed
the
make-dry-run-sever-opt
branch
from
15bd5c9
to
520e96e
Compare
yxxhero
approved these changes
Oct 21, 2023
|
Any ETA for this PR? and new release ? 🥺 🙏 |
|
Related to #449 |
|
It looks like the |
This intends to fix a potential security issue introduced via #458 before cutting the next helm-diff release. Since #458 (unreleased), we had forced helm-diff to use `helm template --dry-run=server` for Helm 3.13 or greater. I think this can create an unintended security hole, where any users, who can run helm-diff via CI or any automation with an arbitrary chart and values, is able to view cluster resources via helm template's `lookup` functions. Previously this was impossible because `helm template` run by `helm diff` had no access to the `lookup` function. To fix this, we need to make `--dry-run=server` optional. And we do so by introducing a new flag `--dry-run=[|client|server]` to helm-diff. See the updated README and the updated helm-diff help message for more details.
mumoshu
force-pushed
the
make-dry-run-sever-opt
branch
from
9391fc9
to
81d9545
Compare
|
@cavedon Thank you very much for testing! I fixed it and added some tests to verify flag parsing is working. |
mumoshu
force-pushed
the
make-dry-run-sever-opt
branch
from
81d9545
to
94c0f4e
Compare
This was referenced Jan 20, 2024
mumoshu
added a commit
that referenced
this pull request
Jan 27, 2024
This is a follow-up on #499 which redoes it without relying on DisableParsing. DisableParsing turned out to break far many things than I imagined!
mumoshu
added a commit
that referenced
this pull request
Jan 27, 2024
This is a follow-up on #499 which redoes it without relying on DisableParsing. DisableParsing turned out to break far many things than I imagined!
mumoshu
added a commit
that referenced
this pull request
Jan 27, 2024
This is a follow-up on #499 which redoes it without relying on DisableParsing. DisableParsing turned out to break far many things than I imagined!
mumoshu
added a commit
that referenced
this pull request
Jan 27, 2024
This is a follow-up on #499 which redoes it without relying on DisableParsing. DisableParsing turned out to break far many things than I imagined!
mumoshu
added a commit
that referenced
this pull request
Jan 27, 2024
This is a follow-up on #499 which redoes it without relying on DisableParsing. DisableParsing turned out to break far many things than I imagined!
yxxhero
added a commit
that referenced
this pull request
Jan 27, 2024
* Remake dry-run=server optional This is a follow-up on #499 which redoes it without relying on DisableParsing. DisableParsing turned out to break far many things than I imagined! * Remove redundant test case * optimze little code Signed-off-by: yxxhero <[email protected]> --------- Signed-off-by: yxxhero <[email protected]> Co-authored-by: yxxhero <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This intends to fix a potential security issue introduced via #458 before cutting the next helm-diff release.
Since #458 (unreleased), we had forced helm-diff to use
helm template --dry-run=serverfor Helm 3.13 or greater.I think this can create an unintended security hole, where any users, who can run helm-diff via CI or any automation with an arbitrary chart and values, is able to view cluster resources via helm template's
lookupfunctions.Previously this was impossible because
helm templaterun byhelm diffhad no access to thelookupfunction. To fix this, we need to make--dry-run=serveroptional. And we do so by changing helm-diff's--dry-runflag to accept only only booleans but alsoclientandserver. The updated flag usage is--dry-run[=[|true|false|client|server]].See the updated README and the updated helm-diff help message for more details.