From 1ff42991b3cac58260f5d12cf3f0da057994bf03 Mon Sep 17 00:00:00 2001 From: jon4hz Date: Fri, 24 Feb 2023 21:57:48 +0100 Subject: [PATCH 1/4] fix: improve filtering of reserved env vars --- cli/packages/cmd/cmd_test.go | 49 ++++++++++++++++++++++++++++++++++++ cli/packages/cmd/run.go | 39 ++++++++++++++++++++++------ 2 files changed, 81 insertions(+), 7 deletions(-) create mode 100644 cli/packages/cmd/cmd_test.go diff --git a/cli/packages/cmd/cmd_test.go b/cli/packages/cmd/cmd_test.go new file mode 100644 index 000000000..d8b683501 --- /dev/null +++ b/cli/packages/cmd/cmd_test.go @@ -0,0 +1,49 @@ +package cmd + +import ( + "testing" + + "github.com/Infisical/infisical-merge/packages/models" +) + +func TestEnvFilter(t *testing.T) { + + // some test env vars. + // HOME and PATH are reserved key words and should be filtered out + // XDG_SESSION_ID and LC_CTYPE are reserved key word prefixes and should be filtered out + // The filter function only checks the keys of the env map, so we dont need to set any values + env := map[string]models.SingleEnvironmentVariable{ + "test": {}, + "test2": {}, + "HOME": {}, + "PATH": {}, + "XDG_SESSION_ID": {}, + "LC_CTYPE": {}, + } + + // check to see if there are any reserved key words in secrets to inject + filterEnvVars(env) + + if len(env) != 2 { + t.Errorf("Expected 2 secrets to be returned, got %d", len(env)) + } + if _, ok := env["test"]; !ok { + t.Errorf("Expected test to be returned") + } + if _, ok := env["test2"]; !ok { + t.Errorf("Expected test2 to be returned") + } + if _, ok := env["HOME"]; ok { + t.Errorf("Expected HOME to be filtered out") + } + if _, ok := env["PATH"]; ok { + t.Errorf("Expected PATH to be filtered out") + } + if _, ok := env["XDG_SESSION_ID"]; ok { + t.Errorf("Expected XDG_SESSION_ID to be filtered out") + } + if _, ok := env["LC_CTYPE"]; ok { + t.Errorf("Expected LC_CTYPE to be filtered out") + } + +} diff --git a/cli/packages/cmd/run.go b/cli/packages/cmd/run.go index f70d29726..9657b739e 100644 --- a/cli/packages/cmd/run.go +++ b/cli/packages/cmd/run.go @@ -110,13 +110,7 @@ var runCmd = &cobra.Command{ } // check to see if there are any reserved key words in secrets to inject - reservedEnvironmentVariables := []string{"HOME", "PATH", "PS1", "PS2"} - for _, reservedEnvName := range reservedEnvironmentVariables { - if _, ok := secretsByKey[reservedEnvName]; ok { - delete(secretsByKey, reservedEnvName) - util.PrintWarning(fmt.Sprintf("Infisical secret named [%v] has been removed because it is a reserved secret name", reservedEnvName)) - } - } + filterEnvVars(secretsByKey) // now add infisical secrets for k, v := range secretsByKey { @@ -149,6 +143,37 @@ var runCmd = &cobra.Command{ }, } +var ( + reservedEnvVars = []string{ + "HOME", "PATH", "PS1", "PS2", + "PWD", "EDITOR", "XAUTHORITY", "USER", + "TERM", "TERMINFO", "SHELL", "MAIL", + } + + reservedEnvVarPrefixes = []string{ + "XDG_", + "LC_", + } +) + +func filterEnvVars(env map[string]models.SingleEnvironmentVariable) { + for _, reservedEnvName := range reservedEnvVars { + if _, ok := env[reservedEnvName]; ok { + delete(env, reservedEnvName) + util.PrintWarning(fmt.Sprintf("Infisical secret named [%v] has been removed because it is a reserved secret name", reservedEnvName)) + } + } + + for _, reservedEnvPrefix := range reservedEnvVarPrefixes { + for envName := range env { + if strings.HasPrefix(envName, reservedEnvPrefix) { + delete(env, envName) + util.PrintWarning(fmt.Sprintf("Infisical secret named [%v] has been removed because it contains a reserved prefix", envName)) + } + } + } +} + func init() { rootCmd.AddCommand(runCmd) runCmd.Flags().String("token", "", "Fetch secrets using the Infisical Token") From 1693db319951f7ba3df6ad8701ec4c274648078e Mon Sep 17 00:00:00 2001 From: jon4hz Date: Fri, 24 Feb 2023 22:03:13 +0100 Subject: [PATCH 2/4] fix: preallocate map size --- cli/packages/cmd/secrets.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go index 625152aa9..93f418d75 100644 --- a/cli/packages/cmd/secrets.go +++ b/cli/packages/cmd/secrets.go @@ -587,7 +587,7 @@ func addHash(input string) string { } func getSecretsByKeys(secrets []models.SingleEnvironmentVariable) map[string]models.SingleEnvironmentVariable { - secretMapByName := make(map[string]models.SingleEnvironmentVariable) + secretMapByName := make(map[string]models.SingleEnvironmentVariable, len(secrets)) for _, secret := range secrets { secretMapByName[secret.Key] = secret From 4a72d725b1038ea86d1cc9888bf78216658682bc Mon Sep 17 00:00:00 2001 From: jon4hz Date: Fri, 24 Feb 2023 22:03:37 +0100 Subject: [PATCH 3/4] fix: use function to get secrets by key --- cli/packages/cmd/secrets.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go index 93f418d75..bbb8d1da4 100644 --- a/cli/packages/cmd/secrets.go +++ b/cli/packages/cmd/secrets.go @@ -361,10 +361,7 @@ func getSecretsByNames(cmd *cobra.Command, args []string) { requestedSecrets := []models.SingleEnvironmentVariable{} - secretsMap := make(map[string]models.SingleEnvironmentVariable) - for _, secret := range secrets { - secretsMap[secret.Key] = secret - } + secretsMap := getSecretsByKeys(secrets) for _, secretKeyFromArg := range args { if value, ok := secretsMap[strings.ToUpper(secretKeyFromArg)]; ok { From 5614b0f58a52bc7cbc219b5a58ccd43213caa0e8 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 24 Feb 2023 22:21:20 -0500 Subject: [PATCH 4/4] nit: method name change --- cli/packages/cmd/cmd_test.go | 4 ++-- cli/packages/cmd/run.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/cli/packages/cmd/cmd_test.go b/cli/packages/cmd/cmd_test.go index d8b683501..f77c6b07b 100644 --- a/cli/packages/cmd/cmd_test.go +++ b/cli/packages/cmd/cmd_test.go @@ -6,7 +6,7 @@ import ( "github.com/Infisical/infisical-merge/packages/models" ) -func TestEnvFilter(t *testing.T) { +func TestFilterReservedEnvVars(t *testing.T) { // some test env vars. // HOME and PATH are reserved key words and should be filtered out @@ -22,7 +22,7 @@ func TestEnvFilter(t *testing.T) { } // check to see if there are any reserved key words in secrets to inject - filterEnvVars(env) + filterReservedEnvVars(env) if len(env) != 2 { t.Errorf("Expected 2 secrets to be returned, got %d", len(env)) diff --git a/cli/packages/cmd/run.go b/cli/packages/cmd/run.go index 9657b739e..63f0ab2d0 100644 --- a/cli/packages/cmd/run.go +++ b/cli/packages/cmd/run.go @@ -110,7 +110,7 @@ var runCmd = &cobra.Command{ } // check to see if there are any reserved key words in secrets to inject - filterEnvVars(secretsByKey) + filterReservedEnvVars(secretsByKey) // now add infisical secrets for k, v := range secretsByKey { @@ -156,7 +156,7 @@ var ( } ) -func filterEnvVars(env map[string]models.SingleEnvironmentVariable) { +func filterReservedEnvVars(env map[string]models.SingleEnvironmentVariable) { for _, reservedEnvName := range reservedEnvVars { if _, ok := env[reservedEnvName]; ok { delete(env, reservedEnvName)