Repository navigation
Refuse YARDMASTER_* variables as provider key names - #25
Merged
Merged
Conversation
A config's api_key_env could name any variable in the container, and switchyard-server was started with its value. A config naming YARDMASTER_SECRET_KEY, with a base URL of the admin's choosing, would send YardMaster's master key (or proxy secret, or admin password) to that server as a bearer token. Provider keys can no longer be read from YARDMASTER_* variables: the wizard and the preview of hand-written TOML refuse such names, the UI can't store a key under one, and a config already applied with one starts without it. The key status also reports such names as missing, so it no longer tells whether one is set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A config's
api_key_envcould name any variable in the container, and switchyard-server was started with its value. A config namingYARDMASTER_SECRET_KEYwith a base URL of the admin's choosing would send YardMaster's master key (or proxy secret, or admin password) to that server as a bearer token. That broke the promise inswitchyardEnvthat YardMaster's own secrets are never passed on. Anyone with an admin session could do this, including through a proxy role mapped to admin.secrets.ValidNamerefuses theYARDMASTER_prefix, so the wizard rejects such names and the UI can't store a key under one.Applier.Previewnames the problem for hand-written TOML. Before this, it would have shown up as a missing key.Store.Envskips invalid names. A config already applied with one starts without that key.Store.Statusreports invalid names as missing, so/api/admin/keys?names=…no longer tells whether a reserved variable is set.Tests cover the wizard, the TOML preview, the store, and the environment switchyard-server gets. Each fails without the fix.