Allow schema-qualified type names in Grant routine args - #436
Open
aravinthAS wants to merge 1 commit into
Open
Conversation
Grant.spec.forProvider.routines[].args validated each argument against ^[a-zA-Z_][a-zA-Z0-9_$]*$, which rejects any dot. This blocks granting EXECUTE on routines whose signature includes a schema-qualified composite type, e.g. AWS RDS's aws_s3.table_import_from_s3(text, text, text, aws_commons._s3_uri_1, aws_commons._aws_credentials_1). The pattern isn't just shape validation: quotedSignatures() in the grant reconciler splices each argument unquoted into the GRANT/REVOKE SQL string, so the pattern is the only thing preventing arbitrary SQL via this field. Widen it to allow exactly one optional schema qualification (^[a-zA-Z_][a-zA-Z0-9_$]*(\.[a-zA-Z_][a-zA-Z0-9_$]*)?$) rather than opening up punctuation generally, so injection payloads still fail to match. Applied identically to both the cluster-scoped and namespaced Grant APIs, which duplicate this type and reconciler. CRDs regenerated via go generate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
Grant.spec.forProvider.routines[].argsvalidates each argumentagainst
^[a-zA-Z_][a-zA-Z0-9_$]*$, which rejects any dot. This blocksgranting
EXECUTEon routines whose signature includes aschema-qualified composite type -- e.g. AWS RDS's
aws_s3.table_import_from_s3:Applying such a
Grantfails at admission with:There's no way to express this grant today.
Root cause / why this isn't just "widen the regex"
The pattern isn't only shape validation -- it's the SQL-injection guard
for this field.
quotedSignatures()in the grant reconciler spliceseach argument unquoted directly into the
GRANT/REVOKE ... ON ROUTINESQL string:So the CRD pattern is the only thing standing between this field and
arbitrary SQL. This PR widens it to allow exactly one optional
schema.typequalification, instead of opening up punctuationgenerally:
This still anchors start/end and only permits a single well-formed
identifier.identifiershape -- injection payloads (; DROP TABLE ..., embedded quotes/parens, extra dots, etc.) still fail to match.Changes
Routine.Argumentsin both the cluster-scoped(
apis/cluster/postgresql/v1alpha1/grant_types.go) and namespaced(
apis/namespaced/postgresql/v1alpha1/grant_types.go) Grant APIs,which duplicate this type.
quotedSignatures()in bothreconcilers to document the widened invariant.
go generate(package/crds/postgresql.sql.crossplane.io_grants.yaml,package/crds/postgresql.sql.m.crossplane.io_grants.yaml) -- onlythe
routines[].argsfield changed.TestRoutineArgumentPattern(newgrant_types_test.goin bothAPI packages) asserting the pattern accepts schema-qualified
identifiers and still rejects malformed/injection input.
RoutineArgumentsAllowSchemaQualifiedCompositeTypesto theexisting
TestGrantSQLtable (both cluster and namespacedreconciler_test.go), asserting the generated GRANT/REVOKE SQL foraws_s3.table_import_from_s3withaws_commons._s3_uri_1/aws_commons._aws_credentials_1args.How has this code been tested
go build ./...go test $(go list ./... | grep -v /test/)-- all packages passgo vet ./...gofmt -lon all changed files -- no outputgo generateregenerated only the two Grant CRDfiles, with only the
argspattern/description changedI have:
make reviewableto ensure this PR is ready for review. (rango build/go test/go vet/gofmtandgo generatedirectly;make reviewableitself wasn't runnable in this environment, see note below)