Compare commits

...

1 Commits

Author SHA1 Message Date
Jason Meridth
a094b7d2a9 sibling of 9f5133479b 2023-08-10 22:43:37 +00:00
205 changed files with 7107 additions and 25543 deletions

View File

@@ -30,7 +30,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: Download all Go modules
@@ -48,7 +48,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: Restore go build cache
@@ -72,14 +72,14 @@ jobs:
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: Run golangci-lint
uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0
with:
version: v1.51.0
args: --enable gofmt --timeout 10m --exclude SA5011 --verbose --max-issues-per-linter 0 --max-same-issues 0
args: --timeout 10m --exclude SA5011 --verbose
test-go:
name: Run unit tests for Go packages
@@ -97,7 +97,7 @@ jobs:
- name: Create symlink in GOPATH
run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: Install required packages
@@ -164,7 +164,7 @@ jobs:
- name: Create symlink in GOPATH
run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: Install required packages
@@ -217,7 +217,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: Create symlink in GOPATH
@@ -265,9 +265,9 @@ jobs:
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup NodeJS
uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
with:
node-version: '20.4.0'
node-version: '20.3.1'
- name: Restore node dependency cache
id: cache-dependencies
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
@@ -381,7 +381,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
- name: GH actions workaround - Kill XSP4 process

View File

@@ -69,17 +69,17 @@ jobs:
if: ${{ github.ref_type != 'tag'}}
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
with:
go-version: ${{ inputs.go-version }}
- name: Install cosign
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1
uses: sigstore/cosign-installer@d13028333d784fcc802b67ec924bcebe75aa0a5f # v3.1.0
with:
cosign-release: 'v2.0.0'
- uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
- uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
- uses: docker/setup-buildx-action@ecf95283f03858871ff00b787d79c419715afc34 # v2.7.0
- name: Setup tags for container image as a CSV type
run: |

View File

@@ -77,7 +77,7 @@ jobs:
fi
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.0.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
with:
go-version: ${{ env.GOLANG_VERSION }}
@@ -95,7 +95,7 @@ jobs:
args: release --clean --timeout 55m
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
KUBECTL_VERSION: ${{ env.KUBECTL_VERSION }}
KUBECTL_VERSION: ${{ env.KUBECTL_VERSION }}
GIT_TREE_STATE: ${{ env.GIT_TREE_STATE }}
- name: Generate subject for provenance
@@ -145,7 +145,7 @@ jobs:
token: ${{ secrets.GITHUB_TOKEN }}
- name: Setup Golang
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
with:
go-version: ${{ env.GOLANG_VERSION }}
@@ -178,7 +178,7 @@ jobs:
fi
cd /tmp && tar -zcf sbom.tar.gz *.spdx
- name: Generate SBOM hash
shell: bash
id: sbom-hash
@@ -187,7 +187,7 @@ jobs:
# base64 -w0 encodes to base64 and outputs on a single line.
# sha256sum /tmp/sbom.tar.gz ... | base64 -w0
echo "hashes=$(sha256sum /tmp/sbom.tar.gz | base64 -w0)" >> "$GITHUB_OUTPUT"
- name: Upload SBOM
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
env:
@@ -195,7 +195,7 @@ jobs:
with:
files: |
/tmp/sbom.tar.gz
sbom-provenance:
needs: [generate-sbom]
permissions:
@@ -209,7 +209,7 @@ jobs:
base64-subjects: "${{ needs.generate-sbom.outputs.hashes }}"
provenance-name: "argocd-sbom.intoto.jsonl"
upload-assets: true
post-release:
needs:
- argocd-image

View File

@@ -83,7 +83,7 @@ WORKDIR /home/argocd
####################################################################################################
# Argo CD UI stage
####################################################################################################
FROM --platform=$BUILDPLATFORM docker.io/library/node:20.5.0@sha256:32ec50b65ac9572eda92baa6004a04dbbfc8021ea806fa62d37336183cad04e6 AS argocd-ui
FROM --platform=$BUILDPLATFORM docker.io/library/node:20.3.1@sha256:2f0b0c15f97441defa812268ee943bbfaaf666ea6cf7cac62ee3f127906b35c6 AS argocd-ui
WORKDIR /src
COPY ["ui/package.json", "ui/yarn.lock", "./"]

View File

@@ -352,7 +352,7 @@ lint-local:
golangci-lint --version
# NOTE: If you get a "Killed" OOM message, try reducing the value of GOGC
# See https://github.com/golangci/golangci-lint#memory-usage-of-golangci-lint
GOGC=$(ARGOCD_LINT_GOGC) GOMAXPROCS=2 golangci-lint run --enable gofmt --fix --verbose --timeout 3000s --max-issues-per-linter 0 --max-same-issues 0
GOGC=$(ARGOCD_LINT_GOGC) GOMAXPROCS=2 golangci-lint run --fix --verbose --timeout 3000s
.PHONY: lint-ui
lint-ui: test-tools-image
@@ -652,4 +652,4 @@ help:
@echo 'codegen:'
@echo ' codegen(-local) -- if using -local, run the following targets first'
@echo ' install-codegen-tools-local -- run this to install the codegen tools'
@echo ' install-go-tools-local -- run this to install go libraries for codegen'
@echo ' install-go-tools-local -- run this to install go libraries for codegen'

View File

@@ -50,7 +50,7 @@ of releasing it within a patch branch for the currently supported releases.
## Reporting a Vulnerability
If you find a security related bug in Argo CD, we kindly ask you for responsible
If you find a security related bug in ArgoCD, we kindly ask you for responsible
disclosure and for giving us appropriate time to react, analyze and develop a
fix to mitigate the found security vulnerability.

View File

@@ -24,7 +24,6 @@ Currently, the following organizations are **officially** using Argo CD:
1. [AppDirect](https://www.appdirect.com)
1. [Arctiq Inc.](https://www.arctiq.ca)
1. [ARZ Allgemeines Rechenzentrum GmbH](https://www.arz.at/)
2. [Autodesk](https://www.autodesk.com)
1. [Axual B.V.](https://axual.com)
1. [Back Market](https://www.backmarket.com)
1. [Baloise](https://www.baloise.com)
@@ -86,7 +85,6 @@ Currently, the following organizations are **officially** using Argo CD:
1. [Farfetch](https://www.farfetch.com)
1. [Faro](https://www.faro.com/)
1. [Fave](https://myfave.com)
1. [Flexport](https://www.flexport.com/)
1. [Flip](https://flip.id)
1. [Fonoa](https://www.fonoa.com/)
1. [freee](https://corp.freee.co.jp/en/company/)
@@ -128,7 +126,6 @@ Currently, the following organizations are **officially** using Argo CD:
1. [Info Support](https://www.infosupport.com/)
1. [InsideBoard](https://www.insideboard.com)
1. [Intuit](https://www.intuit.com/)
1. [Jellysmack](https://www.jellysmack.com)
1. [Joblift](https://joblift.com/)
1. [JovianX](https://www.jovianx.com/)
1. [Kaltura](https://corp.kaltura.com/)
@@ -276,7 +273,6 @@ Currently, the following organizations are **officially** using Argo CD:
1. [Trusting Social](https://trustingsocial.com/)
1. [Twilio SendGrid](https://sendgrid.com)
1. [tZERO](https://www.tzero.com/)
1. [U.S. Veterans Affairs Department](https://www.va.gov/)
1. [UBIO](https://ub.io/)
1. [UFirstGroup](https://www.ufirstgroup.com/en/)
1. [ungleich.ch](https://ungleich.ch/)
@@ -286,7 +282,6 @@ Currently, the following organizations are **officially** using Argo CD:
1. [Vectra](https://www.vectra.ai)
1. [Veepee](https://www.veepee.com)
1. [Viaduct](https://www.viaduct.ai/)
1. [VietMoney](https://vietmoney.vn/)
1. [Vinted](https://vinted.com/)
1. [Virtuo](https://www.govirtuo.com/)
1. [VISITS Technologies](https://visits.world/en)

View File

@@ -1 +1 @@
2.9.0
2.8.0

View File

@@ -448,7 +448,7 @@ func (r *ApplicationSetReconciler) validateGeneratedApplications(ctx context.Con
conditions, err := argoutil.ValidatePermissions(ctx, &app.Spec, proj, r.ArgoDB)
if err != nil {
return nil, fmt.Errorf("error validating permissions: %s", err)
return nil, err
}
if len(conditions) > 0 {
errorsByIndex[i] = fmt.Errorf("application spec is invalid: %s", argoutil.FormatAppConditions(conditions))
@@ -692,7 +692,7 @@ func (r *ApplicationSetReconciler) getCurrentApplications(_ context.Context, app
err := r.Client.List(context.Background(), &current, client.MatchingFields{".metadata.controller": applicationSet.Name})
if err != nil {
return nil, fmt.Errorf("error retrieving applications: %w", err)
return nil, err
}
return current.Items, nil

View File

@@ -74,7 +74,7 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A
// ListCluster from Argo CD's util/db package will include the local cluster in the list of clusters
clustersFromArgoCD, err := utils.ListClusters(g.ctx, g.clientset, g.namespace)
if err != nil {
return nil, fmt.Errorf("error listing clusters: %w", err)
return nil, err
}
if clustersFromArgoCD == nil {
@@ -85,7 +85,7 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A
cm, err := g.clientset.CoreV1().ConfigMaps(g.namespace).Get(g.ctx, appSetGenerator.ClusterDecisionResource.ConfigMapRef, metav1.GetOptions{})
if err != nil {
return nil, fmt.Errorf("error reading configMapRef: %w", err)
return nil, err
}
// Extract GVK data for the dynamic client to use

View File

@@ -125,7 +125,7 @@ func GetRelevantGenerators(requestedGenerator *argoprojiov1alpha1.ApplicationSet
func flattenParameters(in map[string]interface{}) (map[string]string, error) {
flat, err := flatten.Flatten(in, "", flatten.DotStyle)
if err != nil {
return nil, fmt.Errorf("error flatenning parameters: %w", err)
return nil, err
}
out := make(map[string]string, len(flat))

View File

@@ -83,7 +83,7 @@ func (g *ListGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Appli
if err != nil {
return nil, fmt.Errorf("error unmarshling decoded ElementsYaml %v", err)
}
res = append(res, yamlElements...)
res = append(res, yamlElements...)
}
return res, nil

View File

@@ -50,7 +50,7 @@ func (m *MatrixGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.App
g0, err := m.getParams(appSetGenerator.Matrix.Generators[0], appSet, nil)
if err != nil {
return nil, fmt.Errorf("error failed to get params for first generator in matrix generator: %w", err)
return nil, err
}
for _, a := range g0 {
g1, err := m.getParams(appSetGenerator.Matrix.Generators[1], appSet, a)
@@ -94,7 +94,7 @@ func (m *MatrixGenerator) getParams(appSetBaseGenerator argoprojiov1alpha1.Appli
}
mergeGen, err := getMergeGenerator(appSetBaseGenerator)
if err != nil {
return nil, fmt.Errorf("error retrieving merge generator: %w", err)
return nil, err
}
if mergeGen != nil && !appSet.Spec.ApplyNestedSelectors {
foundSelector := dropDisabledNestedSelectors(mergeGen.Generators)

View File

@@ -234,7 +234,7 @@ func getMergeGenerator(r argoprojiov1alpha1.ApplicationSetNestedGenerator) (*arg
}
merge, err := argoprojiov1alpha1.ToNestedMergeGenerator(r.Merge)
if err != nil {
return nil, fmt.Errorf("error converting to nested merge generator: %w", err)
return nil, err
}
return merge.ToMergeGenerator(), nil
}

View File

@@ -81,7 +81,7 @@ func (g *PluginGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.App
res, err := g.generateParams(appSetGenerator, applicationSetInfo, list.Output.Parameters, appSetGenerator.Plugin.Input.Parameters, applicationSetInfo.Spec.GoTemplate)
if err != nil {
return nil, fmt.Errorf("error generating params: %w", err)
return nil, err
}
return res, nil

View File

@@ -27,7 +27,7 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
return pullrequest.NewFakeService(
ctx,
[]*pullrequest.PullRequest{
{
&pullrequest.PullRequest{
Number: 1,
Branch: "branch1",
TargetBranch: "master",
@@ -56,7 +56,7 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
return pullrequest.NewFakeService(
ctx,
[]*pullrequest.PullRequest{
{
&pullrequest.PullRequest{
Number: 2,
Branch: "feat/areally+long_pull_request_name_to_test_argo_slugification_and_branch_name_shortening_feature",
TargetBranch: "feat/anotherreally+long_pull_request_name_to_test_argo_slugification_and_branch_name_shortening_feature",
@@ -85,7 +85,7 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
return pullrequest.NewFakeService(
ctx,
[]*pullrequest.PullRequest{
{
&pullrequest.PullRequest{
Number: 1,
Branch: "a-very-short-sha",
TargetBranch: "master",
@@ -125,7 +125,7 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
return pullrequest.NewFakeService(
ctx,
[]*pullrequest.PullRequest{
{
&pullrequest.PullRequest{
Number: 1,
Branch: "branch1",
TargetBranch: "master",
@@ -162,7 +162,7 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
return pullrequest.NewFakeService(
ctx,
[]*pullrequest.PullRequest{
{
&pullrequest.PullRequest{
Number: 1,
Branch: "branch1",
TargetBranch: "master",

View File

@@ -118,7 +118,7 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
if err != nil {
return nil, fmt.Errorf("error fetching Gitlab token: %v", err)
}
provider, err = scm_provider.NewGitlabProvider(ctx, providerConfig.Gitlab.Group, token, providerConfig.Gitlab.API, providerConfig.Gitlab.AllBranches, providerConfig.Gitlab.IncludeSubgroups, providerConfig.Gitlab.WillIncludeSharedProjects(), providerConfig.Gitlab.Insecure, g.scmRootCAPath)
provider, err = scm_provider.NewGitlabProvider(ctx, providerConfig.Gitlab.Group, token, providerConfig.Gitlab.API, providerConfig.Gitlab.AllBranches, providerConfig.Gitlab.IncludeSubgroups, providerConfig.Gitlab.Insecure, g.scmRootCAPath)
if err != nil {
return nil, fmt.Errorf("error initializing Gitlab service: %v", err)
}

View File

@@ -108,26 +108,26 @@ func TestSCMProviderGenerateParams(t *testing.T) {
},
expected: []map[string]interface{}{
{
"organization": "myorg",
"repository": "repo1",
"url": "git@github.com:myorg/repo1.git",
"branch": "main",
"organization": "myorg",
"repository": "repo1",
"url": "git@github.com:myorg/repo1.git",
"branch": "main",
"branchNormalized": "main",
"sha": "0bc57212c3cbbec69d20b34c507284bd300def5b",
"short_sha": "0bc57212",
"short_sha_7": "0bc5721",
"labels": "prod,staging",
"sha": "0bc57212c3cbbec69d20b34c507284bd300def5b",
"short_sha": "0bc57212",
"short_sha_7": "0bc5721",
"labels": "prod,staging",
},
{
"organization": "myorg",
"repository": "repo2",
"url": "git@github.com:myorg/repo2.git",
"branch": "main",
"organization": "myorg",
"repository": "repo2",
"url": "git@github.com:myorg/repo2.git",
"branch": "main",
"branchNormalized": "main",
"sha": "59d0",
"short_sha": "59d0",
"short_sha_7": "59d0",
"labels": "",
"sha": "59d0",
"short_sha": "59d0",
"short_sha_7": "59d0",
"labels": "",
},
},
},

View File

@@ -269,9 +269,9 @@ func TestGetGiteaPRLabelNames(t *testing.T) {
{
Name: "PR has labels",
PullLabels: []*gitea.Label{
{Name: "label1"},
{Name: "label2"},
{Name: "label3"},
&gitea.Label{Name: "label1"},
&gitea.Label{Name: "label2"},
&gitea.Label{Name: "label3"},
},
ExpectedResult: []string{"label1", "label2", "label3"},
},

View File

@@ -22,9 +22,9 @@ func TestContainLabels(t *testing.T) {
Name: "Match labels",
Labels: []string{"label1", "label2"},
PullLabels: []*github.Label{
{Name: toPtr("label1")},
{Name: toPtr("label2")},
{Name: toPtr("label3")},
&github.Label{Name: toPtr("label1")},
&github.Label{Name: toPtr("label2")},
&github.Label{Name: toPtr("label3")},
},
Expect: true,
},
@@ -32,9 +32,9 @@ func TestContainLabels(t *testing.T) {
Name: "Not match labels",
Labels: []string{"label1", "label4"},
PullLabels: []*github.Label{
{Name: toPtr("label1")},
{Name: toPtr("label2")},
{Name: toPtr("label3")},
&github.Label{Name: toPtr("label1")},
&github.Label{Name: toPtr("label2")},
&github.Label{Name: toPtr("label3")},
},
Expect: false,
},
@@ -42,9 +42,9 @@ func TestContainLabels(t *testing.T) {
Name: "No specify",
Labels: []string{},
PullLabels: []*github.Label{
{Name: toPtr("label1")},
{Name: toPtr("label2")},
{Name: toPtr("label3")},
&github.Label{Name: toPtr("label1")},
&github.Label{Name: toPtr("label2")},
&github.Label{Name: toPtr("label3")},
},
Expect: true,
},
@@ -68,9 +68,9 @@ func TestGetGitHubPRLabelNames(t *testing.T) {
{
Name: "PR has labels",
PullLabels: []*github.Label{
{Name: toPtr("label1")},
{Name: toPtr("label2")},
{Name: toPtr("label3")},
&github.Label{Name: toPtr("label1")},
&github.Label{Name: toPtr("label2")},
&github.Label{Name: toPtr("label3")},
},
ExpectedResult: []string{"label1", "label2", "label3"},
},

View File

@@ -58,13 +58,13 @@ func (a *argoCDService) GetFiles(ctx context.Context, repoURL string, revision s
}
closer, client, err := a.repoServerClientSet.NewRepoServerClient()
if err != nil {
return nil, fmt.Errorf("error initialising new repo server client: %w", err)
return nil, err
}
defer io.Close(closer)
fileResponse, err := client.GetGitFiles(ctx, fileRequest)
if err != nil {
return nil, fmt.Errorf("error retrieving Git files: %w", err)
return nil, err
}
return fileResponse.GetMap(), nil
}
@@ -83,13 +83,13 @@ func (a *argoCDService) GetDirectories(ctx context.Context, repoURL string, revi
closer, client, err := a.repoServerClientSet.NewRepoServerClient()
if err != nil {
return nil, fmt.Errorf("error initialising new repo server client: %w", err)
return nil, err
}
defer io.Close(closer)
dirResponse, err := client.GetGitDirectories(ctx, dirRequest)
if err != nil {
return nil, fmt.Errorf("error retrieving Git Directories: %w", err)
return nil, err
}
return dirResponse.GetPaths(), nil

View File

@@ -5,6 +5,7 @@ import (
"fmt"
"net/http"
"net/http/httptest"
"os"
"testing"
"github.com/stretchr/testify/assert"
@@ -61,7 +62,7 @@ func TestBitbucketHasRepo(t *testing.T) {
}))
defer func() { testServer.Close() }()
t.Setenv("BITBUCKET_API_BASE_URL", testServer.URL)
os.Setenv("BITBUCKET_API_BASE_URL", testServer.URL)
cases := []struct {
name, path, repo, owner, sha string
status int
@@ -448,7 +449,7 @@ func TestBitbucketListRepos(t *testing.T) {
}))
defer func() { testServer.Close() }()
t.Setenv("BITBUCKET_API_BASE_URL", testServer.URL)
os.Setenv("BITBUCKET_API_BASE_URL", testServer.URL)
cases := []struct {
name, proto, owner string
hasError, allBranches bool

View File

@@ -13,16 +13,15 @@ import (
)
type GitlabProvider struct {
client *gitlab.Client
organization string
allBranches bool
includeSubgroups bool
includeSharedProjects bool
client *gitlab.Client
organization string
allBranches bool
includeSubgroups bool
}
var _ SCMProviderService = &GitlabProvider{}
func NewGitlabProvider(ctx context.Context, organization string, token string, url string, allBranches, includeSubgroups, includeSharedProjects, insecure bool, scmRootCAPath string) (*GitlabProvider, error) {
func NewGitlabProvider(ctx context.Context, organization string, token string, url string, allBranches, includeSubgroups, insecure bool, scmRootCAPath string) (*GitlabProvider, error) {
// Undocumented environment variable to set a default token, to be used in testing to dodge anonymous rate limits.
if token == "" {
token = os.Getenv("GITLAB_TOKEN")
@@ -48,8 +47,7 @@ func NewGitlabProvider(ctx context.Context, organization string, token string, u
return nil, err
}
}
return &GitlabProvider{client: client, organization: organization, allBranches: allBranches, includeSubgroups: includeSubgroups, includeSharedProjects: includeSharedProjects}, nil
return &GitlabProvider{client: client, organization: organization, allBranches: allBranches, includeSubgroups: includeSubgroups}, nil
}
func (g *GitlabProvider) GetBranches(ctx context.Context, repo *Repository) ([]*Repository, error) {
@@ -77,9 +75,7 @@ func (g *GitlabProvider) ListRepos(ctx context.Context, cloneProtocol string) ([
opt := &gitlab.ListGroupProjectsOptions{
ListOptions: gitlab.ListOptions{PerPage: 100},
IncludeSubGroups: &g.includeSubgroups,
WithShared: &g.includeSharedProjects,
}
repos := []*Repository{}
for {
gitlabRepos, resp, err := g.client.Groups.ListGroupProjects(g.organization, opt)

View File

@@ -19,7 +19,7 @@ func gitlabMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
switch r.RequestURI {
case "/api/v4":
fmt.Println("here1")
case "/api/v4/groups/test-argocd-proton/projects?include_subgroups=false&per_page=100", "/api/v4/groups/test-argocd-proton/projects?include_subgroups=false&per_page=100&with_shared=false":
case "/api/v4/groups/test-argocd-proton/projects?include_subgroups=false&per_page=100":
fmt.Println("here")
_, err := io.WriteString(w, `[{
"id": 27084533,
@@ -143,501 +143,6 @@ func gitlabMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
if err != nil {
t.Fail()
}
case "/api/v4/groups/test-argocd-proton/projects?include_subgroups=true&per_page=100&with_shared=false":
fmt.Println("here")
_, err := io.WriteString(w, `[{
"id": 27084533,
"description": "",
"name": "argocd",
"name_with_namespace": "test argocd proton / argocd",
"path": "argocd",
"path_with_namespace": "test-argocd-proton/argocd",
"created_at": "2021-06-01T17:30:44.724Z",
"default_branch": "master",
"tag_list": [],
"topics": [],
"ssh_url_to_repo": "git@gitlab.com:test-argocd-proton/argocd.git",
"http_url_to_repo": "https://gitlab.com/test-argocd-proton/argocd.git",
"web_url": "https://gitlab.com/test-argocd-proton/argocd",
"readme_url": null,
"avatar_url": null,
"forks_count": 0,
"star_count": 0,
"last_activity_at": "2021-06-04T08:19:51.656Z",
"namespace": {
"id": 12258515,
"name": "test argocd proton",
"path": "test-argocd-proton",
"kind": "gro* Connection #0 to host gitlab.com left intact up ",
"full_path ": "test - argocd - proton ",
"parent_id ": null,
"avatar_url ": null,
"web_url ": "https: //gitlab.com/groups/test-argocd-proton"
},
"container_registry_image_prefix": "registry.gitlab.com/test-argocd-proton/argocd",
"_links": {
"self": "https://gitlab.com/api/v4/projects/27084533",
"issues": "https://gitlab.com/api/v4/projects/27084533/issues",
"merge_requests": "https://gitlab.com/api/v4/projects/27084533/merge_requests",
"repo_branches": "https://gitlab.com/api/v4/projects/27084533/repository/branches",
"labels": "https://gitlab.com/api/v4/projects/27084533/labels",
"events": "https://gitlab.com/api/v4/projects/27084533/events",
"members": "https://gitlab.com/api/v4/projects/27084533/members",
"cluster_agents": "https://gitlab.com/api/v4/projects/27084533/cluster_agents"
},
"packages_enabled": true,
"empty_repo": false,
"archived": false,
"visibility": "public",
"resolve_outdated_diff_discussions": false,
"container_expiration_policy": {
"cadence": "1d",
"enabled": false,
"keep_n": 10,
"older_than": "90d",
"name_regex": ".*",
"name_regex_keep": null,
"next_run_at": "2021-06-02T17:30:44.740Z"
},
"issues_enabled": true,
"merge_requests_enabled": true,
"wiki_enabled": true,
"jobs_enabled": true,
"snippets_enabled": true,
"container_registry_enabled": true,
"service_desk_enabled": true,
"can_create_merge_request_in": false,
"issues_access_level": "enabled",
"repository_access_level": "enabled",
"merge_requests_access_level": "enabled",
"forking_access_level": "enabled",
"wiki_access_level": "enabled",
"builds_access_level": "enabled",
"snippets_access_level": "enabled",
"pages_access_level": "enabled",
"operations_access_level": "enabled",
"analytics_access_level": "enabled",
"container_registry_access_level": "enabled",
"security_and_compliance_access_level": "private",
"emails_disabled": null,
"shared_runners_enabled": true,
"lfs_enabled": true,
"creator_id": 2378866,
"import_status": "none",
"open_issues_count": 0,
"ci_default_git_depth": 50,
"ci_forward_deployment_enabled": true,
"ci_job_token_scope_enabled": false,
"public_jobs": true,
"build_timeout": 3600,
"auto_cancel_pending_pipelines": "enabled",
"ci_config_path": "",
"shared_with_groups": [],
"only_allow_merge_if_pipeline_succeeds": false,
"allow_merge_on_skipped_pipeline": null,
"restrict_user_defined_variables": false,
"request_access_enabled": true,
"only_allow_merge_if_all_discussions_are_resolved": false,
"remove_source_branch_after_merge": true,
"printing_merge_request_link_enabled": true,
"merge_method": "merge",
"squash_option": "default_off",
"suggestion_commit_message": null,
"merge_commit_template": null,
"squash_commit_template": null,
"auto_devops_enabled": false,
"auto_devops_deploy_strategy": "continuous",
"autoclose_referenced_issues": true,
"keep_latest_artifact": true,
"runner_token_expiration_interval": null,
"approvals_before_merge": 0,
"mirror": false,
"external_authorization_classification_label": "",
"marked_for_deletion_at": null,
"marked_for_deletion_on": null,
"requirements_enabled": true,
"requirements_access_level": "enabled",
"security_and_compliance_enabled": false,
"compliance_frameworks": [],
"issues_template": null,
"merge_requests_template": null,
"merge_pipelines_enabled": false,
"merge_trains_enabled": false
},
{
"id": 27084538,
"description": "This is a Project from a Subgroup",
"name": "argocd-subgroup",
"name_with_namespace": "test argocd proton / subgroup / argocd-subgroup",
"path": "argocd-subgroup",
"path_with_namespace": "test-argocd-proton/subgroup/argocd-subgroup",
"created_at": "2021-06-01T17:30:44.724Z",
"default_branch": "master",
"tag_list": [],
"topics": [],
"ssh_url_to_repo": "git@gitlab.com:test-argocd-proton/subgroup/argocd-subgroup.git",
"http_url_to_repo": "https://gitlab.com/test-argocd-proton/subgroup/argocd-subgroup.git",
"web_url": "https://gitlab.com/test-argocd-proton/subgroup/argocd-subgroup",
"readme_url": null,
"avatar_url": null,
"forks_count": 0,
"star_count": 0,
"last_activity_at": "2021-06-04T08:19:51.656Z",
"namespace": {
"id": 12258542,
"name": "subgroup",
"path": "subgroup",
"kind": "group ",
"full_path ": "test-argocd-proton/subgroup",
"parent_id ": 12258515,
"avatar_url ": null,
"web_url ": "https: //gitlab.com/groups/test-argocd-proton/subgroup"
},
"container_registry_image_prefix": "registry.gitlab.com/test-argocd-proton/subgroup/argocd",
"_links": {
"self": "https://gitlab.com/api/v4/projects/27084538",
"issues": "https://gitlab.com/api/v4/projects/27084538/issues",
"merge_requests": "https://gitlab.com/api/v4/projects/27084538/merge_requests",
"repo_branches": "https://gitlab.com/api/v4/projects/27084538/repository/branches",
"labels": "https://gitlab.com/api/v4/projects/27084538/labels",
"events": "https://gitlab.com/api/v4/projects/27084538/events",
"members": "https://gitlab.com/api/v4/projects/27084538/members",
"cluster_agents": "https://gitlab.com/api/v4/projects/27084538/cluster_agents"
},
"packages_enabled": true,
"empty_repo": false,
"archived": false,
"visibility": "public",
"resolve_outdated_diff_discussions": false,
"container_expiration_policy": {
"cadence": "1d",
"enabled": false,
"keep_n": 10,
"older_than": "90d",
"name_regex": ".*",
"name_regex_keep": null,
"next_run_at": "2021-06-02T17:30:44.740Z"
},
"issues_enabled": true,
"merge_requests_enabled": true,
"wiki_enabled": true,
"jobs_enabled": true,
"snippets_enabled": true,
"container_registry_enabled": true,
"service_desk_enabled": true,
"can_create_merge_request_in": false,
"issues_access_level": "enabled",
"repository_access_level": "enabled",
"merge_requests_access_level": "enabled",
"forking_access_level": "enabled",
"wiki_access_level": "enabled",
"builds_access_level": "enabled",
"snippets_access_level": "enabled",
"pages_access_level": "enabled",
"operations_access_level": "enabled",
"analytics_access_level": "enabled",
"container_registry_access_level": "enabled",
"security_and_compliance_access_level": "private",
"emails_disabled": null,
"shared_runners_enabled": true,
"lfs_enabled": true,
"creator_id": 2378866,
"import_status": "none",
"open_issues_count": 0,
"ci_default_git_depth": 50,
"ci_forward_deployment_enabled": true,
"ci_job_token_scope_enabled": false,
"public_jobs": true,
"build_timeout": 3600,
"auto_cancel_pending_pipelines": "enabled",
"ci_config_path": "",
"shared_with_groups": [],
"only_allow_merge_if_pipeline_succeeds": false,
"allow_merge_on_skipped_pipeline": null,
"restrict_user_defined_variables": false,
"request_access_enabled": true,
"only_allow_merge_if_all_discussions_are_resolved": false,
"remove_source_branch_after_merge": true,
"printing_merge_request_link_enabled": true,
"merge_method": "merge",
"squash_option": "default_off",
"suggestion_commit_message": null,
"merge_commit_template": null,
"squash_commit_template": null,
"auto_devops_enabled": false,
"auto_devops_deploy_strategy": "continuous",
"autoclose_referenced_issues": true,
"keep_latest_artifact": true,
"runner_token_expiration_interval": null,
"approvals_before_merge": 0,
"mirror": false,
"external_authorization_classification_label": "",
"marked_for_deletion_at": null,
"marked_for_deletion_on": null,
"requirements_enabled": true,
"requirements_access_level": "enabled",
"security_and_compliance_enabled": false,
"compliance_frameworks": [],
"issues_template": null,
"merge_requests_template": null,
"merge_pipelines_enabled": false,
"merge_trains_enabled": false
}
]`)
if err != nil {
t.Fail()
}
case "/api/v4/groups/test-argocd-proton/projects?include_subgroups=true&per_page=100&with_shared=true":
fmt.Println("here")
_, err := io.WriteString(w, `[{
"id": 27084533,
"description": "",
"name": "argocd",
"name_with_namespace": "test argocd proton / argocd",
"path": "argocd",
"path_with_namespace": "test-argocd-proton/argocd",
"created_at": "2021-06-01T17:30:44.724Z",
"default_branch": "master",
"tag_list": [],
"topics": [],
"ssh_url_to_repo": "git@gitlab.com:test-argocd-proton/argocd.git",
"http_url_to_repo": "https://gitlab.com/test-argocd-proton/argocd.git",
"web_url": "https://gitlab.com/test-argocd-proton/argocd",
"readme_url": null,
"avatar_url": null,
"forks_count": 0,
"star_count": 0,
"last_activity_at": "2021-06-04T08:19:51.656Z",
"namespace": {
"id": 12258515,
"name": "test argocd proton",
"path": "test-argocd-proton",
"kind": "gro* Connection #0 to host gitlab.com left intact up ",
"full_path ": "test - argocd - proton ",
"parent_id ": null,
"avatar_url ": null,
"web_url ": "https: //gitlab.com/groups/test-argocd-proton"
},
"container_registry_image_prefix": "registry.gitlab.com/test-argocd-proton/argocd",
"_links": {
"self": "https://gitlab.com/api/v4/projects/27084533",
"issues": "https://gitlab.com/api/v4/projects/27084533/issues",
"merge_requests": "https://gitlab.com/api/v4/projects/27084533/merge_requests",
"repo_branches": "https://gitlab.com/api/v4/projects/27084533/repository/branches",
"labels": "https://gitlab.com/api/v4/projects/27084533/labels",
"events": "https://gitlab.com/api/v4/projects/27084533/events",
"members": "https://gitlab.com/api/v4/projects/27084533/members",
"cluster_agents": "https://gitlab.com/api/v4/projects/27084533/cluster_agents"
},
"packages_enabled": true,
"empty_repo": false,
"archived": false,
"visibility": "public",
"resolve_outdated_diff_discussions": false,
"container_expiration_policy": {
"cadence": "1d",
"enabled": false,
"keep_n": 10,
"older_than": "90d",
"name_regex": ".*",
"name_regex_keep": null,
"next_run_at": "2021-06-02T17:30:44.740Z"
},
"issues_enabled": true,
"merge_requests_enabled": true,
"wiki_enabled": true,
"jobs_enabled": true,
"snippets_enabled": true,
"container_registry_enabled": true,
"service_desk_enabled": true,
"can_create_merge_request_in": false,
"issues_access_level": "enabled",
"repository_access_level": "enabled",
"merge_requests_access_level": "enabled",
"forking_access_level": "enabled",
"wiki_access_level": "enabled",
"builds_access_level": "enabled",
"snippets_access_level": "enabled",
"pages_access_level": "enabled",
"operations_access_level": "enabled",
"analytics_access_level": "enabled",
"container_registry_access_level": "enabled",
"security_and_compliance_access_level": "private",
"emails_disabled": null,
"shared_runners_enabled": true,
"lfs_enabled": true,
"creator_id": 2378866,
"import_status": "none",
"open_issues_count": 0,
"ci_default_git_depth": 50,
"ci_forward_deployment_enabled": true,
"ci_job_token_scope_enabled": false,
"public_jobs": true,
"build_timeout": 3600,
"auto_cancel_pending_pipelines": "enabled",
"ci_config_path": "",
"shared_with_groups": [],
"only_allow_merge_if_pipeline_succeeds": false,
"allow_merge_on_skipped_pipeline": null,
"restrict_user_defined_variables": false,
"request_access_enabled": true,
"only_allow_merge_if_all_discussions_are_resolved": false,
"remove_source_branch_after_merge": true,
"printing_merge_request_link_enabled": true,
"merge_method": "merge",
"squash_option": "default_off",
"suggestion_commit_message": null,
"merge_commit_template": null,
"squash_commit_template": null,
"auto_devops_enabled": false,
"auto_devops_deploy_strategy": "continuous",
"autoclose_referenced_issues": true,
"keep_latest_artifact": true,
"runner_token_expiration_interval": null,
"approvals_before_merge": 0,
"mirror": false,
"external_authorization_classification_label": "",
"marked_for_deletion_at": null,
"marked_for_deletion_on": null,
"requirements_enabled": true,
"requirements_access_level": "enabled",
"security_and_compliance_enabled": false,
"compliance_frameworks": [],
"issues_template": null,
"merge_requests_template": null,
"merge_pipelines_enabled": false,
"merge_trains_enabled": false
},
{
"id": 27084534,
"description": "This is a Shared Project",
"name": "shared-argocd",
"name_with_namespace": "shared project to test argocd proton / argocd",
"path": "shared-argocd",
"path_with_namespace": "test-shared-argocd-proton/shared-argocd",
"created_at": "2021-06-11T17:30:44.724Z",
"default_branch": "master",
"tag_list": [],
"topics": [],
"ssh_url_to_repo": "git@gitlab.com:test-shared-argocd-proton/shared-argocd.git",
"http_url_to_repo": "https://gitlab.com/test-shared-argocd-proton/shared-argocd.git",
"web_url": "https://gitlab.com/test-shared-argocd-proton/shared-argocd",
"readme_url": null,
"avatar_url": null,
"forks_count": 0,
"star_count": 0,
"last_activity_at": "2021-06-04T08:19:51.656Z",
"namespace": {
"id": 12258518,
"name": "test shared argocd proton",
"path": "test-shared-argocd-proton",
"kind": "group",
"full_path ": "test-shared-argocd-proton",
"parent_id ": null,
"avatar_url ": null,
"web_url ": "https: //gitlab.com/groups/test-shared-argocd-proton"
},
"container_registry_image_prefix": "registry.gitlab.com/test-shared-argocd-proton/shared-argocd",
"_links": {
"self": "https://gitlab.com/api/v4/projects/27084534",
"issues": "https://gitlab.com/api/v4/projects/27084534/issues",
"merge_requests": "https://gitlab.com/api/v4/projects/27084534/merge_requests",
"repo_branches": "https://gitlab.com/api/v4/projects/27084534/repository/branches",
"labels": "https://gitlab.com/api/v4/projects/27084534/labels",
"events": "https://gitlab.com/api/v4/projects/27084534/events",
"members": "https://gitlab.com/api/v4/projects/27084534/members",
"cluster_agents": "https://gitlab.com/api/v4/projects/27084534/cluster_agents"
},
"packages_enabled": true,
"empty_repo": false,
"archived": false,
"visibility": "public",
"resolve_outdated_diff_discussions": false,
"container_expiration_policy": {
"cadence": "1d",
"enabled": false,
"keep_n": 10,
"older_than": "90d",
"name_regex": ".*",
"name_regex_keep": null,
"next_run_at": "2021-06-12T17:30:44.740Z"
},
"issues_enabled": true,
"merge_requests_enabled": true,
"wiki_enabled": true,
"jobs_enabled": true,
"snippets_enabled": true,
"container_registry_enabled": true,
"service_desk_enabled": true,
"can_create_merge_request_in": false,
"issues_access_level": "enabled",
"repository_access_level": "enabled",
"merge_requests_access_level": "enabled",
"forking_access_level": "enabled",
"wiki_access_level": "enabled",
"builds_access_level": "enabled",
"snippets_access_level": "enabled",
"pages_access_level": "enabled",
"operations_access_level": "enabled",
"analytics_access_level": "enabled",
"container_registry_access_level": "enabled",
"security_and_compliance_access_level": "private",
"emails_disabled": null,
"shared_runners_enabled": true,
"lfs_enabled": true,
"creator_id": 2378866,
"import_status": "none",
"open_issues_count": 0,
"ci_default_git_depth": 50,
"ci_forward_deployment_enabled": true,
"ci_job_token_scope_enabled": false,
"public_jobs": true,
"build_timeout": 3600,
"auto_cancel_pending_pipelines": "enabled",
"ci_config_path": "",
"shared_with_groups": [
{
"group_id": 12258515,
"group_name": "test-argocd-proton",
"group_full_path": "test-shared-argocd-proton",
"group_access_level": 30,
"expires_at": null
}
],
"only_allow_merge_if_pipeline_succeeds": false,
"allow_merge_on_skipped_pipeline": null,
"restrict_user_defined_variables": false,
"request_access_enabled": true,
"only_allow_merge_if_all_discussions_are_resolved": false,
"remove_source_branch_after_merge": true,
"printing_merge_request_link_enabled": true,
"merge_method": "merge",
"squash_option": "default_off",
"suggestion_commit_message": null,
"merge_commit_template": null,
"squash_commit_template": null,
"auto_devops_enabled": false,
"auto_devops_deploy_strategy": "continuous",
"autoclose_referenced_issues": true,
"keep_latest_artifact": true,
"runner_token_expiration_interval": null,
"approvals_before_merge": 0,
"mirror": false,
"external_authorization_classification_label": "",
"marked_for_deletion_at": null,
"marked_for_deletion_on": null,
"requirements_enabled": true,
"requirements_access_level": "enabled",
"security_and_compliance_enabled": false,
"compliance_frameworks": [],
"issues_template": null,
"merge_requests_template": null,
"merge_pipelines_enabled": false,
"merge_trains_enabled": false
}]`)
if err != nil {
t.Fail()
}
case "/api/v4/projects/27084533/repository/branches/master":
fmt.Println("returning")
_, err := io.WriteString(w, `{
@@ -724,116 +229,6 @@ func gitlabMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
if err != nil {
t.Fail()
}
case "/api/v4/projects/27084534/repository/branches?per_page=100":
_, err := io.WriteString(w, `[{
"name": "master",
"commit": {
"id": "8898d7999fc99dd0fd578650b58b244fc63f6b53",
"short_id": "8898d799",
"created_at": "2021-06-04T08:24:44.000+00:00",
"parent_ids": null,
"title": "Merge branch 'pipeline-1317911429' into 'master'",
"message": "Merge branch 'pipeline-1317911429' into 'master'",
"author_name": "Martin Vozník",
"author_email": "martin@voznik.cz",
"authored_date": "2021-06-04T08:24:44.000+00:00",
"committer_name": "Martin Vozník",
"committer_email": "martin@voznik.cz",
"committed_date": "2021-06-04T08:24:44.000+00:00",
"trailers": null,
"web_url": "https://gitlab.com/test-shared-argocd-proton/shared-argocd/-/commit/8898d7999fc99dd0fd578650b58b244fc63f6b53"
},
"merged": false,
"protected": true,
"developers_can_push": false,
"developers_can_merge": false,
"can_push": false,
"default": true,
"web_url": "https://gitlab.com/test-shared-argocd-proton/shared-argocd/-/tree/master"
}, {
"name": "pipeline-2310077506",
"commit": {
"id": "0f92540e5f396ba960adea4ed0aa905baf3f73d1",
"short_id": "0f92540e",
"created_at": "2021-06-01T18:39:59.000+00:00",
"parent_ids": null,
"title": "[testapp-ci] manifests/demo/test-app.yaml: release v1.0.1",
"message": "[testapp-ci] manifests/demo/test-app.yaml: release v1.0.1",
"author_name": "ci-test-app",
"author_email": "mvoznik+cicd@protonmail.com",
"authored_date": "2021-06-01T18:39:59.000+00:00",
"committer_name": "ci-test-app",
"committer_email": "mvoznik+cicd@protonmail.com",
"committed_date": "2021-06-01T18:39:59.000+00:00",
"trailers": null,
"web_url": "https://gitlab.com/test-shared-argocd-proton/shared-argocd/-/commit/0f92540e5f396ba960adea4ed0aa905baf3f73d1"
},
"merged": false,
"protected": false,
"developers_can_push": false,
"developers_can_merge": false,
"can_push": false,
"default": false,
"web_url": "https://gitlab.com/test-shared-argocd-proton/shared-argocd/-/tree/pipeline-1310077506"
}]`)
if err != nil {
t.Fail()
}
case "/api/v4/projects/27084538/repository/branches?per_page=100":
_, err := io.WriteString(w, `[{
"name": "master",
"commit": {
"id": "8898d7999fc99dd0fd578650b58b244fc63f6b58",
"short_id": "8898d801",
"created_at": "2021-06-04T08:24:44.000+00:00",
"parent_ids": null,
"title": "Merge branch 'pipeline-1317911429' into 'master'",
"message": "Merge branch 'pipeline-1317911429' into 'master'",
"author_name": "Martin Vozník",
"author_email": "martin@voznik.cz",
"authored_date": "2021-06-04T08:24:44.000+00:00",
"committer_name": "Martin Vozník",
"committer_email": "martin@voznik.cz",
"committed_date": "2021-06-04T08:24:44.000+00:00",
"trailers": null,
"web_url": "https://gitlab.com/test-argocd-proton/subgroup/argocd-subgroup/-/commit/8898d7999fc99dd0fd578650b58b244fc63f6b53"
},
"merged": false,
"protected": true,
"developers_can_push": false,
"developers_can_merge": false,
"can_push": false,
"default": true,
"web_url": "https://gitlab.com/test-argocd-proton/subgroup/argocd-subgroup/-/tree/master"
}, {
"name": "pipeline-2310077506",
"commit": {
"id": "0f92540e5f396ba960adea4ed0aa905baf3f73d1",
"short_id": "0f92540e",
"created_at": "2021-06-01T18:39:59.000+00:00",
"parent_ids": null,
"title": "[testapp-ci] manifests/demo/test-app.yaml: release v1.0.1",
"message": "[testapp-ci] manifests/demo/test-app.yaml: release v1.0.1",
"author_name": "ci-test-app",
"author_email": "mvoznik+cicd@protonmail.com",
"authored_date": "2021-06-01T18:39:59.000+00:00",
"committer_name": "ci-test-app",
"committer_email": "mvoznik+cicd@protonmail.com",
"committed_date": "2021-06-01T18:39:59.000+00:00",
"trailers": null,
"web_url": "https://gitlab.com/test-argocd-proton/subgroup/argocd-subgroup/-/commit/0f92540e5f396ba960adea4ed0aa905baf3f73d1"
},
"merged": false,
"protected": false,
"developers_can_push": false,
"developers_can_merge": false,
"can_push": false,
"default": false,
"web_url": "https://gitlab.com/test-argocd-proton/subgroup/argocd-subgroup/-/tree/pipeline-1310077506"
}]`)
if err != nil {
t.Fail()
}
case "/api/v4/projects/test-argocd-proton%2Fargocd":
fmt.Println("auct")
_, err := io.WriteString(w, `{
@@ -891,10 +286,10 @@ func gitlabMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
}
func TestGitlabListRepos(t *testing.T) {
cases := []struct {
name, proto, url string
hasError, allBranches, includeSubgroups, includeSharedProjects, insecure bool
branches []string
filters []v1alpha1.SCMProviderGeneratorFilter
name, proto, url string
hasError, allBranches, includeSubgroups, insecure bool
branches []string
filters []v1alpha1.SCMProviderGeneratorFilter
}{
{
name: "blank protocol",
@@ -922,54 +317,32 @@ func TestGitlabListRepos(t *testing.T) {
url: "git@gitlab.com:test-argocd-proton/argocd.git",
branches: []string{"master"},
},
{
name: "all subgroups",
allBranches: true,
url: "git@gitlab.com:test-argocd-proton/argocd.git",
branches: []string{"master"},
includeSharedProjects: false,
includeSubgroups: true,
},
{
name: "all subgroups and shared projects",
allBranches: true,
url: "git@gitlab.com:test-argocd-proton/argocd.git",
branches: []string{"master"},
includeSharedProjects: true,
includeSubgroups: true,
},
}
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
gitlabMockHandler(t)(w, r)
}))
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
provider, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, c.allBranches, c.includeSubgroups, c.includeSharedProjects, c.insecure, "")
provider, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, c.allBranches, c.includeSubgroups, c.insecure, "")
rawRepos, err := ListRepos(context.Background(), provider, c.filters, c.proto)
if c.hasError {
assert.NotNil(t, err)
} else {
assert.Nil(t, err)
// Just check that this one project shows up. Not a great test but better than nothing?
// Just check that this one project shows up. Not a great test but better thing nothing?
repos := []*Repository{}
uniqueRepos := map[string]int{}
branches := []string{}
for _, r := range rawRepos {
if r.Repository == "argocd" {
repos = append(repos, r)
branches = append(branches, r.Branch)
}
uniqueRepos[r.Repository]++
}
assert.NotEmpty(t, repos)
assert.Equal(t, c.url, repos[0].URL)
for _, b := range c.branches {
assert.Contains(t, branches, b)
}
// In case of listing subgroups, validate the number of returned projects
if c.includeSubgroups || c.includeSharedProjects {
assert.Equal(t, 2, len(uniqueRepos))
}
}
})
}
@@ -979,7 +352,7 @@ func TestGitlabHasPath(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
gitlabMockHandler(t)(w, r)
}))
host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true, true, false, "")
host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true, false, "")
repo := &Repository{
Organization: "test-argocd-proton",
Repository: "argocd",
@@ -1025,7 +398,7 @@ func TestGitlabGetBranches(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
gitlabMockHandler(t)(w, r)
}))
host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true, true, false, "")
host, _ := NewGitlabProvider(context.Background(), "test-argocd-proton", "", ts.URL, false, true, false, "")
repo := &Repository{
RepositoryId: 27084533,

View File

@@ -19,9 +19,9 @@ import (
"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1"
argosettings "github.com/argoproj/argo-cd/v2/util/settings"
"github.com/go-playground/webhooks/v6/github"
"github.com/go-playground/webhooks/v6/gitlab"
log "github.com/sirupsen/logrus"
"gopkg.in/go-playground/webhooks.v5/github"
"gopkg.in/go-playground/webhooks.v5/gitlab"
)
type WebhookHandler struct {

View File

@@ -3,6 +3,5 @@ package assets
import "embed"
// Embedded contains embedded assets
//
//go:embed *
var Embedded embed.FS

View File

@@ -5654,8 +5654,19 @@
},
"v1Time": {
"description": "Time is a wrapper around time.Time which supports correct\nmarshaling to YAML and JSON. Wrappers are provided for many\nof the factory methods that the time package offers.\n\n+protobuf.options.marshal=false\n+protobuf.as=Timestamp\n+protobuf.options.(gogoproto.goproto_stringer)=false",
"type": "string",
"format": "date-time"
"type": "object",
"properties": {
"nanos": {
"description": "Non-negative fractions of a second at nanosecond resolution. Negative\nsecond values with fractions must still have non-negative nanos values\nthat count forward in time. Must be from 0 to 999,999,999\ninclusive. This field may be limited in precision depending on context.",
"type": "integer",
"format": "int32"
},
"seconds": {
"description": "Represents seconds of UTC time since Unix epoch\n1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to\n9999-12-31T23:59:59Z inclusive.",
"type": "string",
"format": "int64"
}
}
},
"v1alpha1AWSAuthConfig": {
"type": "object",
@@ -5841,16 +5852,16 @@
"title": "ApplicationDestination holds information about the application's destination",
"properties": {
"name": {
"description": "Name is an alternate way of specifying the target cluster by its symbolic name. This must be set if Server is not set.",
"type": "string"
"type": "string",
"title": "Name is an alternate way of specifying the target cluster by its symbolic name"
},
"namespace": {
"type": "string",
"title": "Namespace specifies the target namespace for the application's resources.\nThe namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace"
},
"server": {
"description": "Server specifies the URL of the target cluster's Kubernetes control plane API. This must be set if Name is not set.",
"type": "string"
"type": "string",
"title": "Server specifies the URL of the target cluster and must be set to the Kubernetes control plane API"
}
}
},
@@ -8212,15 +8223,13 @@
"$ref": "#/definitions/v1alpha1ResourceRef"
}
},
"resourceRef": {
"$ref": "#/definitions/v1alpha1ResourceRef"
},
"resourceVersion": {
"type": "string"
}
},
"allOf": [
{
"$ref": "#/definitions/v1alpha1ResourceRef"
}
]
}
},
"v1alpha1ResourceOverride": {
"type": "object",
@@ -8679,10 +8688,6 @@
"description": "Gitlab group to scan. Required. You can use either the project id (recommended) or the full namespaced path.",
"type": "string"
},
"includeSharedProjects": {
"type": "boolean",
"title": "When recursing through subgroups, also include shared Projects (true) or scan only the subgroups under same path (false). Defaults to \"true\""
},
"includeSubgroups": {
"type": "boolean",
"title": "Recurse through subgroups (true) or scan only the base group (false). Defaults to \"false\""

View File

@@ -56,7 +56,7 @@ func NewCommand() *cobra.Command {
metricsCacheExpiration time.Duration
metricsAplicationLabels []string
kubectlParallelismLimit int64
cacheSource func() (*appstatecache.Cache, error)
cacheSrc func() (*appstatecache.Cache, error)
redisClient *redis.Client
repoServerPlaintext bool
repoServerStrictTLS bool
@@ -126,7 +126,7 @@ func NewCommand() *cobra.Command {
repoClientset := apiclient.NewRepoServerClientset(repoServerAddress, repoServerTimeoutSeconds, tlsConfig)
cache, err := cacheSource()
cache, err := cacheSrc()
errors.CheckError(err)
cache.Cache.SetClient(cacheutil.NewTwoLevelClient(cache.Cache.GetClient(), 10*time.Minute))
@@ -199,7 +199,7 @@ func NewCommand() *cobra.Command {
command.Flags().StringSliceVar(&applicationNamespaces, "application-namespaces", env.StringsFromEnv("ARGOCD_APPLICATION_NAMESPACES", []string{}, ","), "List of additional namespaces that applications are allowed to be reconciled from")
command.Flags().BoolVar(&persistResourceHealth, "persist-resource-health", env.ParseBoolFromEnv("ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH", true), "Enables storing the managed resources health in the Application CRD")
command.Flags().StringVar(&shardingAlgorithm, "sharding-method", env.StringFromEnv(common.EnvControllerShardingAlgorithm, common.DefaultShardingAlgorithm), "Enables choice of sharding method. Supported sharding methods are : [legacy, round-robin] ")
cacheSource = appstatecache.AddCacheFlagsToCmd(&command, func(client *redis.Client) {
cacheSrc = appstatecache.AddCacheFlagsToCmd(&command, func(client *redis.Client) {
redisClient = client
})
return &command

View File

@@ -5,6 +5,7 @@ import (
"math"
"net"
"net/http"
"os"
"time"
"github.com/argoproj/pkg/stats"
@@ -198,6 +199,9 @@ func NewCommand() *cobra.Command {
return nil
},
}
if cmdutil.LogFormat == "" {
cmdutil.LogFormat = os.Getenv("ARGOCD_REPO_SERVER_LOGLEVEL")
}
command.Flags().StringVar(&cmdutil.LogFormat, "logformat", env.StringFromEnv("ARGOCD_REPO_SERVER_LOGFORMAT", "text"), "Set the logging format. One of: text|json")
command.Flags().StringVar(&cmdutil.LogLevel, "loglevel", env.StringFromEnv("ARGOCD_REPO_SERVER_LOGLEVEL", "info"), "Set the logging level. One of: debug|info|warn|error")
command.Flags().Int64Var(&parallelismLimit, "parallelismlimit", int64(env.ParseNumFromEnv("ARGOCD_REPO_SERVER_PARALLELISM_LIMIT", 0, 0, math.MaxInt32)), "Limit on number of concurrent manifests generate requests. Any value less the 1 means no limit.")

View File

@@ -130,9 +130,9 @@ has appropriate RBAC permissions to change other accounts.
},
}
command.Flags().StringVar(&currentPassword, "current-password", "", "Password of the currently logged on user")
command.Flags().StringVar(&newPassword, "new-password", "", "New password you want to update to")
command.Flags().StringVar(&account, "account", "", "An account name that should be updated. Defaults to current user account")
command.Flags().StringVar(&currentPassword, "current-password", "", "password of the currently logged on user")
command.Flags().StringVar(&newPassword, "new-password", "", "new password you want to update to")
command.Flags().StringVar(&account, "account", "", "an account name that should be updated. Defaults to current user account")
return command
}

View File

@@ -307,8 +307,8 @@ func Test_groupObjsByKey(t *testing.T) {
}
expected := map[kube.ResourceKey]*unstructured.Unstructured{
{Group: "", Kind: "Pod", Namespace: "default", Name: "pod-name"}: localObjs[0],
{Group: "apiextensions.k8s.io", Kind: "CustomResourceDefinition", Namespace: "", Name: "certificates.cert-manager.io"}: localObjs[1],
kube.ResourceKey{Group: "", Kind: "Pod", Namespace: "default", Name: "pod-name"}: localObjs[0],
kube.ResourceKey{Group: "apiextensions.k8s.io", Kind: "CustomResourceDefinition", Namespace: "", Name: "certificates.cert-manager.io"}: localObjs[1],
}
objByKey := groupObjsByKey(localObjs, liveObjs, "default")

View File

@@ -40,12 +40,12 @@ func TestPrintApplicationSetTable(t *testing.T) {
},
Spec: v1alpha1.ApplicationSetSpec{
Generators: []v1alpha1.ApplicationSetGenerator{
{
v1alpha1.ApplicationSetGenerator{
Git: &v1alpha1.GitGenerator{
RepoURL: "https://github.com/argoproj/argo-cd.git",
Revision: "head",
Directories: []v1alpha1.GitDirectoryGeneratorItem{
{
v1alpha1.GitDirectoryGeneratorItem{
Path: "applicationset/examples/git-generator-directory/cluster-addons/*",
},
},
@@ -60,7 +60,7 @@ func TestPrintApplicationSetTable(t *testing.T) {
},
Status: v1alpha1.ApplicationSetStatus{
Conditions: []v1alpha1.ApplicationSetCondition{
{
v1alpha1.ApplicationSetCondition{
Status: v1alpha1.ApplicationSetConditionStatusTrue,
Type: v1alpha1.ApplicationSetConditionResourcesUpToDate,
},
@@ -75,12 +75,12 @@ func TestPrintApplicationSetTable(t *testing.T) {
},
Spec: v1alpha1.ApplicationSetSpec{
Generators: []v1alpha1.ApplicationSetGenerator{
{
v1alpha1.ApplicationSetGenerator{
Git: &v1alpha1.GitGenerator{
RepoURL: "https://github.com/argoproj/argo-cd.git",
Revision: "head",
Directories: []v1alpha1.GitDirectoryGeneratorItem{
{
v1alpha1.GitDirectoryGeneratorItem{
Path: "applicationset/examples/git-generator-directory/cluster-addons/*",
},
},
@@ -95,7 +95,7 @@ func TestPrintApplicationSetTable(t *testing.T) {
},
Status: v1alpha1.ApplicationSetStatus{
Conditions: []v1alpha1.ApplicationSetCondition{
{
v1alpha1.ApplicationSetCondition{
Status: v1alpha1.ApplicationSetConditionStatusTrue,
Type: v1alpha1.ApplicationSetConditionResourcesUpToDate,
},
@@ -118,12 +118,12 @@ func TestPrintAppSetSummaryTable(t *testing.T) {
},
Spec: v1alpha1.ApplicationSetSpec{
Generators: []v1alpha1.ApplicationSetGenerator{
{
v1alpha1.ApplicationSetGenerator{
Git: &v1alpha1.GitGenerator{
RepoURL: "https://github.com/argoproj/argo-cd.git",
Revision: "head",
Directories: []v1alpha1.GitDirectoryGeneratorItem{
{
v1alpha1.GitDirectoryGeneratorItem{
Path: "applicationset/examples/git-generator-directory/cluster-addons/*",
},
},
@@ -138,7 +138,7 @@ func TestPrintAppSetSummaryTable(t *testing.T) {
},
Status: v1alpha1.ApplicationSetStatus{
Conditions: []v1alpha1.ApplicationSetCondition{
{
v1alpha1.ApplicationSetCondition{
Status: v1alpha1.ApplicationSetConditionStatusTrue,
Type: v1alpha1.ApplicationSetConditionResourcesUpToDate,
},

View File

@@ -130,7 +130,7 @@ func NewCertAddTLSCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
}
},
}
command.Flags().StringVar(&fromFile, "from", "", "Read TLS certificate data from file (default is to read from stdin)")
command.Flags().StringVar(&fromFile, "from", "", "read TLS certificate data from file (default is to read from stdin)")
command.Flags().BoolVar(&upsert, "upsert", false, "Replace existing TLS certificate if certificate is different in input")
return command
}
@@ -300,9 +300,9 @@ func NewCertListCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
}
command.Flags().StringVarP(&output, "output", "o", "wide", "Output format. One of: json|yaml|wide")
command.Flags().StringVar(&sortOrder, "sort", "", "Set display sort order for output format wide. One of: hostname|type")
command.Flags().StringVar(&certType, "cert-type", "", "Only list certificates of given type, valid: 'ssh','https'")
command.Flags().StringVar(&hostNamePattern, "hostname-pattern", "", "Only list certificates for hosts matching given glob-pattern")
command.Flags().StringVar(&sortOrder, "sort", "", "set display sort order for output format wide. One of: hostname|type")
command.Flags().StringVar(&certType, "cert-type", "", "only list certificates of given type, valid: 'ssh','https'")
command.Flags().StringVar(&hostNamePattern, "hostname-pattern", "", "only list certificates for hosts matching given glob-pattern")
return command
}

View File

@@ -56,7 +56,7 @@ var (
descAppInfo = prometheus.NewDesc(
"argocd_app_info",
"Information about application.",
append(descAppDefaultLabels, "autosync_enabled", "repo", "dest_server", "dest_namespace", "sync_status", "health_status", "operation"),
append(descAppDefaultLabels, "repo", "dest_server", "dest_namespace", "sync_status", "health_status", "operation"),
nil,
)
// DEPRECATED
@@ -381,9 +381,7 @@ func (c *appCollector) collectApps(ch chan<- prometheus.Metric, app *argoappv1.A
healthStatus = health.HealthStatusUnknown
}
autoSyncEnabled := app.Spec.SyncPolicy != nil && app.Spec.SyncPolicy.Automated != nil
addGauge(descAppInfo, 1, strconv.FormatBool(autoSyncEnabled), git.NormalizeGitURL(app.Spec.GetSource().RepoURL), app.Spec.Destination.Server, app.Spec.Destination.Namespace, string(syncStatus), string(healthStatus), operation)
addGauge(descAppInfo, 1, git.NormalizeGitURL(app.Spec.GetSource().RepoURL), app.Spec.Destination.Server, app.Spec.Destination.Namespace, string(syncStatus), string(healthStatus), operation)
if len(c.appLabels) > 0 {
labelValues := []string{}

View File

@@ -5,6 +5,7 @@ import (
"log"
"net/http"
"net/http/httptest"
"os"
"strings"
"testing"
"time"
@@ -66,10 +67,6 @@ spec:
source:
path: some/path
repoURL: https://github.com/argoproj/argocd-example-apps.git
syncPolicy:
automated:
selfHeal: false
prune: true
status:
sync:
status: Synced
@@ -101,10 +98,6 @@ spec:
source:
path: some/path
repoURL: https://github.com/argoproj/argocd-example-apps.git
syncPolicy:
automated:
selfHeal: true
prune: false
status:
sync:
status: OutOfSync
@@ -235,9 +228,9 @@ func TestMetrics(t *testing.T) {
responseContains: `
# HELP argocd_app_info Information about application.
# TYPE argocd_app_info gauge
argocd_app_info{autosync_enabled="true",dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Degraded",name="my-app-3",namespace="argocd",operation="delete",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="OutOfSync"} 1
argocd_app_info{autosync_enabled="false",dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app",namespace="argocd",operation="",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
argocd_app_info{autosync_enabled="true",dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app-2",namespace="argocd",operation="sync",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Degraded",name="my-app-3",namespace="argocd",operation="delete",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="OutOfSync"} 1
argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app",namespace="argocd",operation="",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app-2",namespace="argocd",operation="sync",project="important-project",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
`,
},
{
@@ -245,7 +238,7 @@ argocd_app_info{autosync_enabled="true",dest_namespace="dummy-namespace",dest_se
responseContains: `
# HELP argocd_app_info Information about application.
# TYPE argocd_app_info gauge
argocd_app_info{autosync_enabled="false",dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app",namespace="argocd",operation="",project="default",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
argocd_app_info{dest_namespace="dummy-namespace",dest_server="https://localhost:6443",health_status="Healthy",name="my-app",namespace="argocd",operation="",project="default",repo="https://github.com/argoproj/argocd-example-apps",sync_status="Synced"} 1
`,
},
}
@@ -299,7 +292,8 @@ argocd_app_labels{label_non_existing="",name="my-app-3",namespace="argocd",proje
}
func TestLegacyMetrics(t *testing.T) {
t.Setenv(EnvVarLegacyControllerMetrics, "true")
os.Setenv(EnvVarLegacyControllerMetrics, "true")
defer os.Unsetenv(EnvVarLegacyControllerMetrics)
expectedResponse := `
# HELP argocd_app_created_time Creation time in unix timestamp for an application.

View File

@@ -14,7 +14,7 @@ import (
)
func TestGetShardByID_NotEmptyID(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "1")
os.Setenv(common.EnvControllerReplicas, "1")
assert.Equal(t, 0, LegacyDistributionFunction()(&v1alpha1.Cluster{ID: "1"}))
assert.Equal(t, 0, LegacyDistributionFunction()(&v1alpha1.Cluster{ID: "2"}))
assert.Equal(t, 0, LegacyDistributionFunction()(&v1alpha1.Cluster{ID: "3"}))
@@ -22,21 +22,21 @@ func TestGetShardByID_NotEmptyID(t *testing.T) {
}
func TestGetShardByID_EmptyID(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "1")
os.Setenv(common.EnvControllerReplicas, "1")
distributionFunction := LegacyDistributionFunction
shard := distributionFunction()(&v1alpha1.Cluster{})
assert.Equal(t, 0, shard)
}
func TestGetShardByID_NoReplicas(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "0")
os.Setenv(common.EnvControllerReplicas, "0")
distributionFunction := LegacyDistributionFunction
shard := distributionFunction()(&v1alpha1.Cluster{})
assert.Equal(t, -1, shard)
}
func TestGetShardByID_NoReplicasUsingHashDistributionFunction(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "0")
os.Setenv(common.EnvControllerReplicas, "0")
distributionFunction := LegacyDistributionFunction
shard := distributionFunction()(&v1alpha1.Cluster{})
assert.Equal(t, -1, shard)
@@ -45,8 +45,8 @@ func TestGetShardByID_NoReplicasUsingHashDistributionFunction(t *testing.T) {
func TestGetShardByID_NoReplicasUsingHashDistributionFunctionWithClusters(t *testing.T) {
db, cluster1, cluster2, cluster3, cluster4, cluster5 := createTestClusters()
// Test with replicas set to 0
t.Setenv(common.EnvControllerReplicas, "0")
t.Setenv(common.EnvControllerShardingAlgorithm, common.RoundRobinShardingAlgorithm)
os.Setenv(common.EnvControllerReplicas, "0")
os.Setenv(common.EnvControllerShardingAlgorithm, common.RoundRobinShardingAlgorithm)
distributionFunction := RoundRobinDistributionFunction(db)
assert.Equal(t, -1, distributionFunction(nil))
assert.Equal(t, -1, distributionFunction(&cluster1))
@@ -54,12 +54,13 @@ func TestGetShardByID_NoReplicasUsingHashDistributionFunctionWithClusters(t *tes
assert.Equal(t, -1, distributionFunction(&cluster3))
assert.Equal(t, -1, distributionFunction(&cluster4))
assert.Equal(t, -1, distributionFunction(&cluster5))
}
func TestGetClusterFilterDefault(t *testing.T) {
shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
os.Unsetenv(common.EnvControllerShardingAlgorithm)
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
filter := GetClusterFilter(GetDistributionFunction(nil, common.DefaultShardingAlgorithm), shardIndex)
assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
@@ -69,8 +70,8 @@ func TestGetClusterFilterDefault(t *testing.T) {
func TestGetClusterFilterLegacy(t *testing.T) {
shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
t.Setenv(common.EnvControllerReplicas, "2")
t.Setenv(common.EnvControllerShardingAlgorithm, common.LegacyShardingAlgorithm)
os.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerShardingAlgorithm, common.LegacyShardingAlgorithm)
filter := GetClusterFilter(GetDistributionFunction(nil, common.LegacyShardingAlgorithm), shardIndex)
assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
@@ -80,8 +81,8 @@ func TestGetClusterFilterLegacy(t *testing.T) {
func TestGetClusterFilterUnknown(t *testing.T) {
shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
t.Setenv(common.EnvControllerReplicas, "2")
t.Setenv(common.EnvControllerShardingAlgorithm, "unknown")
os.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerShardingAlgorithm, "unknown")
filter := GetClusterFilter(GetDistributionFunction(nil, "unknown"), shardIndex)
assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
assert.True(t, filter(&v1alpha1.Cluster{ID: "2"}))
@@ -91,7 +92,7 @@ func TestGetClusterFilterUnknown(t *testing.T) {
func TestLegacyGetClusterFilterWithFixedShard(t *testing.T) {
shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
filter := GetClusterFilter(GetDistributionFunction(nil, common.DefaultShardingAlgorithm), shardIndex)
assert.False(t, filter(nil))
assert.False(t, filter(&v1alpha1.Cluster{ID: "1"}))
@@ -106,11 +107,12 @@ func TestLegacyGetClusterFilterWithFixedShard(t *testing.T) {
fixedShard = 1
filter = GetClusterFilter(GetDistributionFunction(nil, common.DefaultShardingAlgorithm), int(fixedShard))
assert.True(t, filter(&v1alpha1.Cluster{Name: "cluster4", ID: "4", Shard: &fixedShard}))
}
func TestRoundRobinGetClusterFilterWithFixedShard(t *testing.T) {
shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
filter := GetClusterFilter(GetDistributionFunction(db, common.RoundRobinShardingAlgorithm), shardIndex)
@@ -133,8 +135,8 @@ func TestRoundRobinGetClusterFilterWithFixedShard(t *testing.T) {
func TestGetClusterFilterLegacyHash(t *testing.T) {
shardIndex := 1 // ensuring that a shard with index 1 will process all the clusters with an "even" id (2,4,6,...)
t.Setenv(common.EnvControllerReplicas, "2")
t.Setenv(common.EnvControllerShardingAlgorithm, "hash")
os.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerShardingAlgorithm, "hash")
db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
filter := GetClusterFilter(GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
assert.False(t, filter(&cluster1))
@@ -156,64 +158,55 @@ func TestGetClusterFilterLegacyHash(t *testing.T) {
func TestGetClusterFilterWithEnvControllerShardingAlgorithms(t *testing.T) {
db, cluster1, cluster2, cluster3, cluster4, _ := createTestClusters()
shardIndex := 1
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerShardingAlgorithm, common.LegacyShardingAlgorithm)
shardShouldProcessCluster := GetClusterFilter(GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
assert.False(t, shardShouldProcessCluster(&cluster1))
assert.True(t, shardShouldProcessCluster(&cluster2))
assert.False(t, shardShouldProcessCluster(&cluster3))
assert.True(t, shardShouldProcessCluster(&cluster4))
assert.False(t, shardShouldProcessCluster(nil))
t.Run("legacy", func(t *testing.T) {
t.Setenv(common.EnvControllerShardingAlgorithm, common.LegacyShardingAlgorithm)
shardShouldProcessCluster := GetClusterFilter(GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
assert.False(t, shardShouldProcessCluster(&cluster1))
assert.True(t, shardShouldProcessCluster(&cluster2))
assert.False(t, shardShouldProcessCluster(&cluster3))
assert.True(t, shardShouldProcessCluster(&cluster4))
assert.False(t, shardShouldProcessCluster(nil))
})
t.Run("roundrobin", func(t *testing.T) {
t.Setenv(common.EnvControllerShardingAlgorithm, common.RoundRobinShardingAlgorithm)
shardShouldProcessCluster := GetClusterFilter(GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
assert.False(t, shardShouldProcessCluster(&cluster1))
assert.True(t, shardShouldProcessCluster(&cluster2))
assert.False(t, shardShouldProcessCluster(&cluster3))
assert.True(t, shardShouldProcessCluster(&cluster4))
assert.False(t, shardShouldProcessCluster(nil))
})
os.Setenv(common.EnvControllerShardingAlgorithm, common.RoundRobinShardingAlgorithm)
shardShouldProcessCluster = GetClusterFilter(GetDistributionFunction(db, common.LegacyShardingAlgorithm), shardIndex)
assert.False(t, shardShouldProcessCluster(&cluster1))
assert.True(t, shardShouldProcessCluster(&cluster2))
assert.False(t, shardShouldProcessCluster(&cluster3))
assert.True(t, shardShouldProcessCluster(&cluster4))
assert.False(t, shardShouldProcessCluster(nil))
}
func TestGetShardByIndexModuloReplicasCountDistributionFunction2(t *testing.T) {
db, cluster1, cluster2, cluster3, cluster4, cluster5 := createTestClusters()
// Test with replicas set to 1
os.Setenv(common.EnvControllerReplicas, "1")
distributionFunction := RoundRobinDistributionFunction(db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
assert.Equal(t, 0, distributionFunction(&cluster2))
assert.Equal(t, 0, distributionFunction(&cluster3))
assert.Equal(t, 0, distributionFunction(&cluster4))
assert.Equal(t, 0, distributionFunction(&cluster5))
t.Run("replicas set to 1", func(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "1")
distributionFunction := RoundRobinDistributionFunction(db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
assert.Equal(t, 0, distributionFunction(&cluster2))
assert.Equal(t, 0, distributionFunction(&cluster3))
assert.Equal(t, 0, distributionFunction(&cluster4))
assert.Equal(t, 0, distributionFunction(&cluster5))
})
// Test with replicas set to 2
os.Setenv(common.EnvControllerReplicas, "2")
distributionFunction = RoundRobinDistributionFunction(db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
assert.Equal(t, 1, distributionFunction(&cluster2))
assert.Equal(t, 0, distributionFunction(&cluster3))
assert.Equal(t, 1, distributionFunction(&cluster4))
assert.Equal(t, 0, distributionFunction(&cluster5))
t.Run("replicas set to 2", func(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "2")
distributionFunction := RoundRobinDistributionFunction(db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
assert.Equal(t, 1, distributionFunction(&cluster2))
assert.Equal(t, 0, distributionFunction(&cluster3))
assert.Equal(t, 1, distributionFunction(&cluster4))
assert.Equal(t, 0, distributionFunction(&cluster5))
})
t.Run("replicas set to 3", func(t *testing.T) {
t.Setenv(common.EnvControllerReplicas, "3")
distributionFunction := RoundRobinDistributionFunction(db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
assert.Equal(t, 1, distributionFunction(&cluster2))
assert.Equal(t, 2, distributionFunction(&cluster3))
assert.Equal(t, 0, distributionFunction(&cluster4))
assert.Equal(t, 1, distributionFunction(&cluster5))
})
// // Test with replicas set to 3
os.Setenv(common.EnvControllerReplicas, "3")
distributionFunction = RoundRobinDistributionFunction(db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
assert.Equal(t, 1, distributionFunction(&cluster2))
assert.Equal(t, 2, distributionFunction(&cluster3))
assert.Equal(t, 0, distributionFunction(&cluster4))
assert.Equal(t, 1, distributionFunction(&cluster5))
}
func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterNumberIsHigh(t *testing.T) {
@@ -229,7 +222,7 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterNumber
clusterList.Items = append(clusterList.Items, cluster)
}
db.On("ListClusters", mock.Anything).Return(clusterList, nil)
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
distributionFunction := RoundRobinDistributionFunction(&db)
for i, c := range clusterList.Items {
assert.Equal(t, i%2, distributionFunction(&c))
@@ -249,7 +242,7 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterIsAdde
db.On("ListClusters", mock.Anything).Return(clusterList, nil)
// Test with replicas set to 2
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
distributionFunction := RoundRobinDistributionFunction(&db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))
@@ -266,11 +259,12 @@ func TestGetShardByIndexModuloReplicasCountDistributionFunctionWhenClusterIsAdde
// Now, we remove the last added cluster, it should be unassigned as well
clusterList.Items = clusterList.Items[:len(clusterList.Items)-1]
assert.Equal(t, -1, distributionFunction(&cluster6))
}
func TestGetShardByIndexModuloReplicasCountDistributionFunction(t *testing.T) {
db, cluster1, cluster2, _, _, _ := createTestClusters()
t.Setenv(common.EnvControllerReplicas, "2")
os.Setenv(common.EnvControllerReplicas, "2")
distributionFunction := RoundRobinDistributionFunction(db)
// Test that the function returns the correct shard for cluster1 and cluster2
@@ -309,6 +303,7 @@ func TestInferShard(t *testing.T) {
osHostnameFunction = func() (string, error) { return "example-shard", nil }
_, err = InferShard()
assert.NotNil(t, err)
}
func createTestClusters() (*dbmocks.ArgoDB, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster, v1alpha1.Cluster) {

View File

@@ -3,6 +3,7 @@ package sharding
import (
"fmt"
"math"
"os"
"testing"
"github.com/argoproj/argo-cd/v2/common"
@@ -23,7 +24,7 @@ func TestLargeShuffle(t *testing.T) {
}
db.On("ListClusters", mock.Anything).Return(clusterList, nil)
// Test with replicas set to 256
t.Setenv(common.EnvControllerReplicas, "256")
os.Setenv(common.EnvControllerReplicas, "256")
distributionFunction := RoundRobinDistributionFunction(&db)
for i, c := range clusterList.Items {
assert.Equal(t, i%2567, distributionFunction(&c))
@@ -46,7 +47,7 @@ func TestShuffle(t *testing.T) {
db.On("ListClusters", mock.Anything).Return(clusterList, nil)
// Test with replicas set to 3
t.Setenv(common.EnvControllerReplicas, "3")
os.Setenv(common.EnvControllerReplicas, "3")
distributionFunction := RoundRobinDistributionFunction(&db)
assert.Equal(t, 0, distributionFunction(nil))
assert.Equal(t, 0, distributionFunction(&cluster1))

View File

@@ -341,6 +341,7 @@ func TestAppRevisionsSingleSource(t *testing.T) {
assert.NotNil(t, compRes.syncStatus)
assert.NotEmpty(t, compRes.syncStatus.Revision)
assert.Len(t, compRes.syncStatus.Revisions, 0)
}
// TestAppRevisions tests that revisions are properly propagated for a multi source app
@@ -707,8 +708,9 @@ var signedProj = argoappv1.AppProject{
}
func TestSignedResponseNoSignatureRequired(t *testing.T) {
t.Setenv("ARGOCD_GPG_ENABLED", "true")
oldval := os.Getenv("ARGOCD_GPG_ENABLED")
os.Setenv("ARGOCD_GPG_ENABLED", "true")
defer os.Setenv("ARGOCD_GPG_ENABLED", oldval)
// We have a good signature response, but project does not require signed commits
{
app := newFakeApp()
@@ -764,7 +766,9 @@ func TestSignedResponseNoSignatureRequired(t *testing.T) {
}
func TestSignedResponseSignatureRequired(t *testing.T) {
t.Setenv("ARGOCD_GPG_ENABLED", "true")
oldval := os.Getenv("ARGOCD_GPG_ENABLED")
os.Setenv("ARGOCD_GPG_ENABLED", "true")
defer os.Setenv("ARGOCD_GPG_ENABLED", oldval)
// We have a good signature response, valid key, and signing is required - sync!
{
@@ -930,7 +934,7 @@ func TestSignedResponseSignatureRequired(t *testing.T) {
assert.Contains(t, app.Status.Conditions[0].Message, "Cannot use local manifests")
}
t.Setenv("ARGOCD_GPG_ENABLED", "false")
os.Setenv("ARGOCD_GPG_ENABLED", "false")
// We have a bad signature response and signing would be required, but GPG subsystem is disabled - sync
{
app := newFakeApp()
@@ -986,6 +990,7 @@ func TestSignedResponseSignatureRequired(t *testing.T) {
assert.Len(t, compRes.managedResources, 0)
assert.Len(t, app.Status.Conditions, 0)
}
}
func TestComparisonResult_GetHealthStatus(t *testing.T) {

View File

@@ -2,6 +2,7 @@ package controller
import (
"context"
"os"
"testing"
"github.com/argoproj/gitops-engine/pkg/sync"
@@ -178,7 +179,8 @@ func TestSyncComparisonError(t *testing.T) {
opState := &v1alpha1.OperationState{Operation: v1alpha1.Operation{
Sync: &v1alpha1.SyncOperation{},
}}
t.Setenv("ARGOCD_GPG_ENABLED", "true")
os.Setenv("ARGOCD_GPG_ENABLED", "true")
defer os.Setenv("ARGOCD_GPG_ENABLED", "false")
ctrl.appStateManager.SyncAppState(app, opState)
conditions := app.Status.GetConditions(map[v1alpha1.ApplicationConditionType]bool{v1alpha1.ApplicationConditionComparisonError: true})

Binary file not shown.

Before

Width:  |  Height:  |  Size: 40 KiB

View File

@@ -2,7 +2,7 @@
## Introduction
Argo CD is released in a 2 step automated fashion using GitHub actions. The release process takes about 60 minutes,
ArgoCD is released in a 2 step automated fashion using GitHub actions. The release process takes about 60 minutes,
sometimes a little less, depending on the performance of GitHub Actions runners.
The target release branch must already exist in the GitHub repository. If you for

View File

@@ -139,7 +139,7 @@ See [#1482](https://github.com/argoproj/argo-cd/issues/1482).
## How often does Argo CD check for changes to my Git or Helm repository ?
The default polling interval is 3 minutes (180 seconds).
You can change the setting by updating the `timeout.reconciliation` value in the [argocd-cm](https://github.com/argoproj/argo-cd/blob/2d6ce088acd4fb29271ffb6f6023dbb27594d59b/docs/operator-manual/argocd-cm.yaml#L279-L282) config map. If there are any Git changes, Argo CD will only update applications with the [auto-sync setting](user-guide/auto_sync.md) enabled. If you set it to `0` then Argo CD will stop polling Git repositories automatically and you can only use alternative methods such as [webhooks](operator-manual/webhook.md) and/or manual syncs for deploying applications.
You can change the setting by updating the `timeout.reconciliation` value in the [argocd-cm](https://github.com/argoproj/argo-cd/blob/2d6ce088acd4fb29271ffb6f6023dbb27594d59b/docs/operator-manual/argocd-cm.yaml#L279-L282) config map. If there are any Git changes, ArgoCD will only update applications with the [auto-sync setting](user-guide/auto_sync.md) enabled. If you set it to `0` then Argo CD will stop polling Git repositories automatically and you can only use alternative methods such as [webhooks](operator-manual/webhook.md) and/or manual syncs for deploying applications.
## Why Are My Resource Limits `Out Of Sync`?
@@ -194,7 +194,7 @@ argocd ... --insecure
## I have configured Dex via `dex.config` in `argocd-cm`, it still says Dex is unconfigured. Why?
Most likely you forgot to set the `url` in `argocd-cm` to point to your Argo CD as well. See also
Most likely you forgot to set the `url` in `argocd-cm` to point to your ArgoCD as well. See also
[the docs](./operator-manual/user-management/index.md#2-configure-argo-cd-for-sso).
## Why are `SealedSecret` resources reporting a `Status`?
@@ -208,14 +208,14 @@ fixed CRD if you want this feature to work at all.
## <a name="sealed-secret-stuck-progressing"></a>Why are resources of type `SealedSecret` stuck in the `Progressing` state?
The controller of the `SealedSecret` resource may expose the status condition on resource it provisioned. Since
version `v2.0.0` Argo CD picks up that status condition to derive a health status for the `SealedSecret`.
version `v2.0.0` ArgoCD picks up that status condition to derive a health status for the `SealedSecret`.
Versions before `v0.15.0` of the `SealedSecret` controller are affected by an issue regarding this status
conditions updates, which is why this feature is disabled by default in these versions. Status condition updates may be
enabled by starting the `SealedSecret` controller with the `--update-status` command line parameter or by setting
the `SEALED_SECRETS_UPDATE_STATUS` environment variable.
To disable Argo CD from checking the status condition on `SealedSecret` resources, add the following resource
To disable ArgoCD from checking the status condition on `SealedSecret` resources, add the following resource
customization in your `argocd-cm` ConfigMap via `resource.customizations.health.<group_kind>` key.
```yaml

View File

@@ -25,7 +25,7 @@ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/st
```
Follow our [getting started guide](getting_started.md). Further user oriented [documentation](user-guide/)
is provided for additional features. If you are looking to upgrade Argo CD, see the [upgrade guide](./operator-manual/upgrading/overview.md).
is provided for additional features. If you are looking to upgrade ArgoCD, see the [upgrade guide](./operator-manual/upgrading/overview.md).
Developer oriented [documentation](developer-guide/) is available for people interested in building third-party integrations.
## How it works

View File

@@ -94,8 +94,8 @@ metadata:
type: Opaque
data:
# ...
# The secret value must be base64 encoded **once**.
# this value corresponds to: `printf "strong-password" | base64`.
# The secret value must be base64 encoded **once**
# this value corresponds to: `printf "strong-password" | base64`
plugin.myplugin.token: "c3Ryb25nLXBhc3N3b3Jk"
# ...
```
@@ -124,9 +124,9 @@ type: Opaque
data:
# ...
# Store client secret like below.
# The secret value must be base64 encoded **once**.
# This value corresponds to: `printf "strong-password" | base64`.
plugin.myplugin.token: "c3Ryb25nLXBhc3N3b3Jk"
# Ensure the secret is base64 encoded
plugin.myplugin.token: <client-secret-base64-encoded>
# ...
```
### HTTP server
@@ -138,7 +138,7 @@ You can deploy it either as a sidecar or as a standalone deployment (the latter
In the example, the token is stored in a file at this location : `/var/run/argo/token`
```
strong-password
string-password
```
```python
@@ -199,7 +199,7 @@ if __name__ == '__main__':
Execute getparams with curl :
```
curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer strong-password" -d \
curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer string-password" -d \
'{
"applicationSetName": "fake-appset",
"input": {
@@ -283,7 +283,7 @@ To illustrate :
- The generator plugin would then perform 2 requests as follows :
```shell
curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer strong-password" -d \
curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer string-password" -d \
'{
"applicationSetName": "fb-matrix",
"input": {
@@ -297,7 +297,7 @@ curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer st
Then,
```shell
curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer strong-password" -d \
curl http://localhost:4355/api/v1/getparams.execute -H "Authorization: Bearer string-password" -d \
'{
"applicationSetName": "fb-matrix",
"input": {

View File

@@ -232,7 +232,7 @@ spec:
- `api`: Optional URL to access the Bitbucket REST API. For the example above, an API request would be made to `https://api.bitbucket.org/2.0/repositories/{workspace}/{repo_slug}/pullrequests`. If not set, defaults to `https://api.bitbucket.org/2.0`
- `branchMatch`: Optional regexp filter which should match the source branch name. This is an alternative to labels which are not supported by Bitbucket server.
If you want to access a private repository, Argo CD will need credentials to access repository in Bitbucket Cloud. You can use Bitbucket App Password (generated per user, with access to whole workspace), or Bitbucket App Token (generated per repository, with access limited to repository scope only). If both App Password and App Token are defined, App Token will be used.
If you want to access a private repository, ArgoCD will need credentials to access repository in Bitbucket Cloud. You can use Bitbucket App Password (generated per user, with access to whole workspace), or Bitbucket App Token (generated per repository, with access limited to repository scope only). If both App Password and App Token are defined, App Token will be used.
To use Bitbucket App Password, use `basicAuth` section.
- `username`: The username to authenticate with. It only needs read access to the relevant repo.

View File

@@ -87,9 +87,6 @@ spec:
allBranches: true
# If true, recurses through subgroups. If false, it searches only in the base group. Defaults to false.
includeSubgroups: true
# If true and includeSubgroups is also true, include Shared Projects, which is gitlab API default.
# If false only search Projects under the same path. Defaults to true.
includeSharedProjects: false
# Reference to a Secret containing an access token. (optional)
tokenRef:
secretName: gitlab-token
@@ -104,7 +101,6 @@ spec:
* `api`: If using self-hosted GitLab, the URL to access it.
* `allBranches`: By default (false) the template will only be evaluated for the default branch of each repo. If this is true, every branch of every repository will be passed to the filters. If using this flag, you likely want to use a `branchMatch` filter.
* `includeSubgroups`: By default (false) the controller will only search for repos directly in the base group. If this is true, it will recurse through all the subgroups searching for repos to scan.
* `includeSharedProjects`: If true and includeSubgroups is also true, include Shared Projects, which is gitlab API default. If false only search Projects under the same path. In general most would want the behaviour when set to false. Defaults to true.
* `tokenRef`: A `Secret` name and key containing the GitLab access token to use for requests. If not specified, will make anonymous requests which have a lower rate limit and can only see public repositories.
* `insecure`: By default (false) - Skip checking the validity of the SCM's certificate - useful for self-signed TLS certificates.
@@ -318,7 +314,7 @@ Depending on whether `role` is provided in `awsCodeCommit` property, AWS IAM per
#### Discover AWS CodeCommit Repositories in the same AWS Account as ApplicationSet Controller
Without specifying `role`, ApplicationSet controller will use its own AWS identity to scan AWS CodeCommit repos.
This is suitable when you have a simple setup that all AWS CodeCommit repos reside in the same AWS account as your Argo CD.
This is suitable when you have a simple setup that all AWS CodeCommit repos reside in the same AWS account as your ArgoCD.
As the ApplicationSet controller AWS identity is used directly for repo discovery, it must be granted below AWS permissions.

View File

@@ -209,7 +209,7 @@ metadata:
argocd.argoproj.io/secret-type: repository
stringData:
type: git
url: git@github.com:argoproj/my-private-repository.git
url: git@github.com:argoproj/my-private-repository
sshPrivateKey: |
-----BEGIN OPENSSH PRIVATE KEY-----
...

View File

@@ -37,7 +37,7 @@ Each link in the list has five subfields:
As mentioned earlier the links and conditions can be templated to use data from the resource, each category of links can access different types of data linked to that resource.
Overall we have these 4 resources available for templating in the system:
- `app` or `application`: this key is used to access the application resource data.
- `application`: this key is used to access the application resource data.
- `resource`: this key is used to access values for the actual k8s resource.
- `cluster`: this key is used to access the related destination cluster data like name, server, namespaces etc.
- `project`: this key is used to access the project resource data.
@@ -45,7 +45,7 @@ Overall we have these 4 resources available for templating in the system:
The above resources are accessible in particular link categories, here's a list of resources available in each category:
- `resource.links`: `resource`, `application`, `cluster` and `project`
- `application.links`: `app`/`application` and `cluster`
- `application.links`: `application` and `cluster`
- `project.links`: `project`
An example `argocd-cm.yaml` file with deep links and their variations :
@@ -60,16 +60,16 @@ An example `argocd-cm.yaml` file with deep links and their variations :
# sample application level links
application.links: |
# pkg.go.dev/text/template is used for evaluating url templates
- url: https://mycompany.splunk.com?search={{.app.spec.destination.namespace}}&env={{.project.metadata.labels.env}}
- url: https://mycompany.splunk.com?search={{.application.spec.destination.namespace}}&env={{.project.metadata.labels.env}}
title: Splunk
# conditionally show link e.g. for specific project
# github.com/antonmedv/expr is used for evaluation of conditions
- url: https://mycompany.splunk.com?search={{.app.spec.destination.namespace}}
- url: https://mycompany.splunk.com?search={{.application.spec.destination.namespace}}
title: Splunk
if: application.spec.project == "default"
- url: https://{{.app.metadata.annotations.splunkhost}}?search={{.app.spec.destination.namespace}}
- url: https://{{.application.metadata.annotations.splunkhost}}?search={{.application.spec.destination.namespace}}
title: Splunk
if: app.metadata.annotations.splunkhost != ""
if: application.metadata.annotations.splunkhost != ""
# sample resource level links
resource.links: |
- url: https://mycompany.splunk.com?search={{.resource.metadata.name}}&env={{.project.metadata.labels.env}}

View File

@@ -414,132 +414,6 @@ Once we create this service, we can configure the Ingress to conditionally route
- argocd.argoproj.io
```
## [Istio](https://www.istio.io)
You can put Argo CD behind Istio using following configurations. Here we will achive both serving Argo CD behind istio and using subpath on Istio
First we need to make sure that we can run Argo CD with subpath (ie /argocd). For this we have used install.yaml from argocd project as is
```bash
curl -kLs -o install.yaml https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
```
save following file as kustomization.yml
```yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./install.yaml
patches:
- path: ./patch.yml
```
And following lines as patch.yml
```yaml
# Use --insecure so Ingress can send traffic with HTTP
# --bashref /argocd is the subpath like https://IP/argocd
# env was added because of https://github.com/argoproj/argo-cd/issues/3572 error
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-server
spec:
template:
spec:
containers:
- args:
- /usr/local/bin/argocd-server
- --staticassets
- /shared/app
- --redis
- argocd-redis-ha-haproxy:6379
- --insecure
- --basehref
- /argocd
- --rootpath
- /argocd
name: argocd-server
env:
- name: ARGOCD_MAX_CONCURRENT_LOGIN_REQUESTS_COUNT
value: "0"
```
After that install Argo CD (there should be only 3 yml file defined above in current directory )
```bash
kubectl apply -k ./ -n argocd --wait=true
```
Be sure you create secret for Isito ( in our case secretname is argocd-server-tls on argocd Namespace). After that we create Istio Resources
```yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: argocd-gateway
namespace: argocd
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
tls:
httpsRedirect: true
- port:
number: 443
name: https
protocol: HTTPS
hosts:
- "*"
tls:
credentialName: argocd-server-tls
maxProtocolVersion: TLSV1_3
minProtocolVersion: TLSV1_2
mode: SIMPLE
cipherSuites:
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES128-SHA
- AES128-GCM-SHA256
- AES128-SHA
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-ECDSA-AES256-SHA
- AES256-GCM-SHA384
- AES256-SHA
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: argocd-virtualservice
namespace: argocd
spec:
hosts:
- "*"
gateways:
- argocd-gateway
http:
- match:
- uri:
prefix: /argocd
route:
- destination:
host: argocd-server
port:
number: 80
```
And now we can browse http://{{ IP }}/argocd (it will be rewritten to https://{{ IP }}/argocd
## Google Cloud load balancers with Kubernetes Ingress
You can make use of the integration of GKE with Google Cloud to deploy Load Balancers using just Kubernetes objects.
@@ -712,7 +586,7 @@ Once the DNS change is propagated, you're ready to use Argo with your Google Clo
## Authenticating through multiple layers of authenticating reverse proxies
Argo CD endpoints may be protected by one or more reverse proxies layers, in that case, you can provide additional headers through the `argocd` CLI `--header` parameter to authenticate through those layers.
ArgoCD endpoints may be protected by one or more reverse proxies layers, in that case, you can provide additional headers through the `argocd` CLI `--header` parameter to authenticate through those layers.
```shell
$ argocd login <host>:<port> --header 'x-token1:foo' --header 'x-token2:bar' # can be repeated multiple times
@@ -720,7 +594,7 @@ $ argocd login <host>:<port> --header 'x-token1:foo,x-token2:bar' # headers can
```
## ArgoCD Server and UI Root Path (v1.5.3)
Argo CD server and UI can be configured to be available under a non-root path (e.g. `/argo-cd`).
ArgoCD server and UI can be configured to be available under a non-root path (e.g. `/argo-cd`).
To do this, add the `--rootpath` flag into the `argocd-server` deployment command:
```yaml

View File

@@ -7,7 +7,7 @@ Metrics about applications. Scraped at the `argocd-metrics:8082/metrics` endpoin
| Metric | Type | Description |
|--------|:----:|-------------|
| `argocd_app_info` | gauge | Information about Applications. It contains labels such as `sync_status` and `health_status` that reflect the application state in Argo CD. |
| `argocd_app_info` | gauge | Information about Applications. It contains labels such as `sync_status` and `health_status` that reflect the application state in ArgoCD. |
| `argocd_app_k8s_request_total` | counter | Number of kubernetes requests executed during application reconciliation |
| `argocd_app_labels` | gauge | Argo Application labels converted to Prometheus labels. Disabled by default. See section below about how to enable it. |
| `argocd_app_reconcile` | histogram | Application reconciliation performance. |
@@ -23,7 +23,7 @@ Metrics about applications. Scraped at the `argocd-metrics:8082/metrics` endpoin
| `argocd_redis_request_duration` | histogram | Redis requests duration. |
| `argocd_redis_request_total` | counter | Number of redis requests executed during application reconciliation |
If you use Argo CD with many application and project creation and deletion,
If you use ArgoCD with many application and project creation and deletion,
the metrics page will keep in cache your application and project's history.
If you are having issues because of a large number of metrics cardinality due
to deleted resources, you can schedule a metrics reset to clean the
@@ -32,16 +32,16 @@ history with an application controller flag. Example:
### Exposing Application labels as Prometheus metrics
There are use-cases where Argo CD Applications contain labels that are desired to be exposed as Prometheus metrics.
There are use-cases where ArgoCD Applications contain labels that are desired to be exposed as Prometheus metrics.
Some examples are:
* Having the team name as a label to allow routing alerts to specific receivers
* Creating dashboards broken down by business units
As the Application labels are specific to each company, this feature is disabled by default. To enable it, add the
`--metrics-application-labels` flag to the Argo CD application controller.
`--metrics-application-labels` flag to the ArgoCD application controller.
The example below will expose the Argo CD Application labels `team-name` and `business-unit` to Prometheus:
The example below will expose the ArgoCD Application labels `team-name` and `business-unit` to Prometheus:
containers:
- command:

View File

@@ -173,7 +173,7 @@ kubectl edit clusterrole argocd-application-controller
```
!!! tip
If you want to deny Argo CD access to a kind of resource then add it as an [excluded resource](declarative-setup.md#resource-exclusion).
If you want to deny ArgoCD access to a kind of resource then add it as an [excluded resource](declarative-setup.md#resource-exclusion).
## Auditing

View File

@@ -142,7 +142,7 @@ A single attestation (`argocd-sbom.intoto.jsonl`) from each release is provided
slsa-verifier verify-artifact sbom.tar.gz \
--provenance-path argocd-sbom.intoto.jsonl \
--source-uri github.com/argoproj/argo-cd \
--source-tag v2.7.0
--source-tag v2.8.0
```
***

View File

@@ -1,6 +1,5 @@
| Argo CD version | Kubernetes versions |
|-----------------|---------------------|
| 2.8 | v1.27, v1.26, v1.25, v1.24 |
| 2.7 | v1.26, v1.25, v1.24, v1.23 |
| 2.6 | v1.24, v1.23, v1.22 |
| 2.5 | v1.24, v1.23, v1.22 |

View File

@@ -44,24 +44,6 @@ Each user might have two capabilities:
* apiKey - allows generating authentication tokens for API access
* login - allows to login using UI
### Delete user
In order to delete a user, you must remove the corresponding entry defined in the `argocd-cm` ConfigMap:
Example:
```bash
kubectl patch -n argocd cm argocd-cm --type='json' -p='[{"op": "remove", "path": "/data/accounts.alice"}]'
```
It is recommended to also remove the password entry in the `argocd-secret` Secret:
Example:
```bash
kubectl patch -n argocd secrets argocd-secret --type='json' -p='[{"op": "remove", "path": "/data/accounts.alice.password"}]'
```
### Disable admin user
As soon as additional users are created it is recommended to disable `admin` user:

View File

@@ -4,7 +4,7 @@
Argo CD polls Git repositories every three minutes to detect changes to the manifests. To eliminate
this delay from polling, the API server can be configured to receive webhook events. Argo CD supports
Git webhook notifications from GitHub, GitLab, Bitbucket, Bitbucket Server, Azure DevOps and Gogs. The following explains how to configure
Git webhook notifications from GitHub, GitLab, Bitbucket, Bitbucket Server and Gogs. The following explains how to configure
a Git webhook for GitHub, but the same process should be applicable to other providers.
!!! note
@@ -12,28 +12,19 @@ a Git webhook for GitHub, but the same process should be applicable to other pro
the same. A hook event for a push to branch `x` will trigger a refresh for an app pointing at the same repo with
`targetRevision: refs/tags/x`.
## 1. Create The WebHook In The Git Provider
### 1. Create The WebHook In The Git Provider
In your Git provider, navigate to the settings page where webhooks can be configured. The payload
URL configured in the Git provider should use the `/api/webhook` endpoint of your Argo CD instance
(e.g. `https://argocd.example.com/api/webhook`). If you wish to use a shared secret, input an
arbitrary value in the secret. This value will be used when configuring the webhook in the next step.
## Github
![Add Webhook](../assets/webhook-config.png "Add Webhook")
!!! note
When creating the webhook in GitHub, the "Content type" needs to be set to "application/json". The default value "application/x-www-form-urlencoded" is not supported by the library used to handle the hooks
## Azure DevOps
![Add Webhook](../assets/azure-devops-webhook-config.png "Add Webhook")
Azure DevOps optionally supports securing the webhook using basic authentication. To use it, specify the username and password in the webhook configuration and configure the same username/password in `argocd-secret` Kubernetes secret in
`webhook.azuredevops.username` and `webhook.azuredevops.password` keys.
## 2. Configure Argo CD With The WebHook Secret (Optional)
### 2. Configure Argo CD With The WebHook Secret (Optional)
Configuring a webhook shared secret is optional, since Argo CD will still refresh applications
related to the Git repository, even with unauthenticated webhook events. This is safe to do since
@@ -45,14 +36,12 @@ In the `argocd-secret` kubernetes secret, configure one of the following keys wi
provider's webhook secret configured in step 1.
| Provider | K8s Secret Key |
|-----------------|----------------------------------|
|-----------------| ---------------------------------|
| GitHub | `webhook.github.secret` |
| GitLab | `webhook.gitlab.secret` |
| BitBucket | `webhook.bitbucket.uuid` |
| BitBucketServer | `webhook.bitbucketserver.secret` |
| Gogs | `webhook.gogs.secret` |
| Azure DevOps | `webhook.azuredevops.username` |
| | `webhook.azuredevops.password` |
Edit the Argo CD kubernetes secret:
@@ -90,10 +79,6 @@ stringData:
# gogs server webhook secret
webhook.gogs.secret: shhhh! it's a gogs server secret
# azuredevops username and password
webhook.azuredevops.username: admin
webhook.azuredevops.password: secret-password
```
After saving, the changes should take effect automatically.

View File

@@ -1,49 +0,0 @@
---
title: Offering Feature Bounties (Experimental)
authors:
- "@crenshaw-dev"
- "@todaywasawesome"
sponsors:
- "@jannfis"
reviewers:
- TBD
approvers:
- TBD
creation-date: 2023-06-27
---
# Offering Feature Bounties (Experimental)
## Summary
We'd like to have the ability to offer monetary rewards for significant features to be added to Argo.
## Motivation
The Argo Project is driven by community contributions and in shared trust with maintainer companies. Sometimes there are important features worth investing in that represent substantial work and are tougher, or take longer to implement.
By providing a financial incentive, we can spur additional development from the community and indepdent contributors.
## Proposal
Add the ability to mark a proposal with a bounty and a specific amount. When a PR is successfully merged, release payment to the PR author(s).
This proposal is experimental, meaning after trying a single bounty, we will review as a project and decide if we would like to continue this program. Accepting this proposal only constitutes the program for a single bounty as an experiment.
### Guidelines and Rules
#### Creating a Bounty
A bounty is a special proposal created under `docs/proposals/feature-bounties`.
* A bounty proposal may only be created by an existing Argo maintainer.
* The proposal document must be reviewed in regular maintainer meetings and an invitation for feedback will provide 7-days to comment.
* Bounty should have approval with [lazy-consensus](https://community.apache.org/committers/lazyConsensus.html)
* Once a bounty is created, they must be honored.
* Bounty progress will be tracked in a GitHub issue linked in the proposal.
* Creating a bounty requires the funds be available and not already committed elsewhere.
#### Claiming a Bounty
* Argo will pay out bounties once a pull request implementing the requested features/changes/fixes is merged.
* A bounty is limited to a single successful PR.
* Those interested in working on the bounty are encouraged to comment on the issue, and users may team up to split a bounty if they prefer but collaboration is not required and users should not shame eachother for their preferences to work alone or together.
* A comment of interest does not constitute a claim and will not be treated as such.
* The first pull request submitted that is ready for merge will be reviewed by maintainers. Maintainers will also consider any competing pull requests submitted within 24-hours. We expect this will be a very rare circumstance. If multiple, high-quality, merge ready pull requests are submitted, 3-5 Approvers for the sub-project will vote to decide the final pull request merged.
### Funding
The Argo Project has a small amount of funds from HackerOne bounties that can provide for a few feature bounties.

View File

@@ -1,135 +0,0 @@
---
title: Argo CD first-class OCI support
authors:
- "@sabre1041"
- "@crenshaw-dev"
- "@todaywasawesome"
sponsors:
- TBD
reviewers:
- "@alexmt"
approvers:
- "@alexmt"
creation-date: 2023-05-09
---
# Argo CD first-class OCI support
Storing and retrieving manifests within in OCI registries
## Summary
Currently, Argo CD supports obtaining manifests from either a Git repository, a Helm chart repository, or a Helm chart stored within an OCI registry. Given that OCI registries are more frequently being used to store content aside from container images, introduce a mechanism for storing and retrieving manifests that can be used by any of the existing supported tools in any of the supported methods of representing assets that are to be applied to a Kubernetes environment.
## Motivation
The industry is seeing a rapid adoption of OCI Artifacts as a method for storing and retrieving content. Adding support for sourcing resources stored in OCI artifacts not only provides immediate benefits, but opens up additional possible integrations in the future.
**Dependency Reduction**
At the present time, a user must have access to either a Git repository, or a remote Helm chart repository. Most users or enterprise organizations already have access to an OCI registry as it represents the primary source of image related content within a Kubernetes environment. By sourcing assets from OCI registries, no additional infrastructure is required in order to store a variety of content types simplifying the set of requirements in order to begin to fully leverage the capabilities of Argo CD.
**Market Relevance**
Argo CD continues to be one of the most popular GitOps tools in the industry. As the industry continues to evolve, other tools within the GitOps market have already began to adopt OCI artifacts as a source for storing and retrieving GitOps resources.
### Goals
* Enable the retrieval of resources stored as artifacts in OCI registries that are formatted in any of the supported options (Kustomize, Jsonnet, Helm, plain-manifest, CMPs, etc)
* Define a format for storing resources that can be processed by Argo CD as an OCI artifact including the composition and [Media Type(s)](https://github.com/opencontainers/image-spec/blob/main/media-types.md)
* Support the retrieval of artifacts from OCI registries using custom / self signed TLS certificates.
* Support the retrieval of artifacts from OCI registries requiring authentication.
### Non-Goals
* CLI Integration to package and publish resources in a format for storage in an OCI registry
* Attach metadata to OCI artifact manifest to provide additional details related to the content (such as original Git source [URL, revision])
## Proposal
This is where we get down to details of what the proposal is about.
### Use cases
Add a list of detailed use cases this enhancement intends to take care of.
#### Publishing and retrieval of content from OCI registries:
As a user, I would like to make use of content that is represented by any of the supported options (Kustomize, Jsonnet, Helm, plain-manifest, etc) or those that could be consumed using a Config Management Plugin from an OCI registry.
#### Authenticating to OCI registries:
As a user, I would like to enforce proper security controls by requiring authentication to an OCI registry and configure Argo CD to be able to interact with this registry.
#### CLI Integration:
As a user, I would like the ability to produce, store and retrieve resources (pull/push) in a OCI registry using the Argo CD CLI.
### Implementation Details/Notes/Constraints
The Argo CD repo-server currently maintains two types of clients - Helm and git. By adding a third client, and invoking it in the same places as the other two, we can support OCI artifacts.
It seems likely that we should create a new, common interface to represent all three clients. Then we can instantiate the client we need, toggling on whatever value in the repo config determines what kind of repo we're fetching from.
#### Format of OCI Artifact
An OCI artifact can contain any type of binary content. It is important that the content be formatted in a manner that can be consumed by Argo CD.
#### Content
Resources that is consumed by Argo CD can be represented by a series of files and folders. To be stored within an OCI artifact, these assets are stored within a compressed tar archive (.tar.gz) OCI layer. The [OCI Image Specification](https://specs.opencontainers.org/image-spec/) allows for metadata to be added through the use of annotations to provide attribute based details describing the included content. This level of detail is important as it satisfies many of the existing capabilities of Argo CD for tracking content, such as Git repository URL, branch name/revision.
#### Media Types
The [OCI Image Specification](https://specs.opencontainers.org/image-spec/) makes extensive use of Media Types to identity the format of content. To provide not only a way that signifies the content of the OCI artifact contains Argo CD manifests, but to define the structure of the content. An understanding of the composition and requirements enable a broad ecosystem of tooling that can be used to produce and consume Argo CD resources within OCI registries.
Two new Media Types will be used for this purpose as defined below:
* `application/vnd.cncf.argoproj.argocd.content.v1.tar+gzip` - Primary asset stored within the OCI artifact containing a gzip compressed tar archive of Argo CD resources. Further details are outlined in the prior section.
* `application/vnd.cncf.argoproj.argocd.config.v1+json` - An [OCI Image Configuration](https://specs.opencontainers.org/image-spec/config/)
### Detailed examples
### Security Considerations
The direct integration with an external endpoint from the core subsystem of Argo CD introduces several considerations as it relates to security. It is worthy to note that Argo CD currently does support sourcing Helm charts that are stored within OCI registries. However, this interaction is performed by Helm and its underlying library, [ORAS](https://oras.land), and not Argo CD itself. Capabilities included within this proposal can make use of the same libraries to facilitate the interaction.
#### Credentials
Security controls may be enforced within the OCI registry to enforce that clients authenticate. The introduction of additional mechanisms to authenticate against target systems is outside the scope of this proposal. However, an integration with existing capabilities and features, such as sourcing from _repository_ credentials is required.
### Risks and Mitigation's
#### Overlap with existing Helm OCI integration
Argo CD already includes support for sourcing Helm Charts from OCI registries and the retrieval is delegated to functionality provided by Helm. Considerations must be taken into account to determine whether the intent by the end user is to consume an OCI artifact containing Argo CD related resources or a Helm chart. One such method for addressing this concern is to inspect the `mediaType` of the OCI artifact.
### Upgrade / Downgrade Strategy
If applicable, how will the component be upgraded and downgraded? Make sure this is in the test
plan.
Consider the following in developing an upgrade/downgrade strategy for this enhancement:
- What changes (in invocations, configurations, API use, etc.) is an existing cluster required to
make on upgrade in order to keep previous behavior?
- What changes (in invocations, configurations, API use, etc.) is an existing cluster required to
make on upgrade in order to make use of the enhancement?
## Drawbacks
* Sourcing content from an OCI registry may be perceived to be against GitOps principles as content is not sourced from a Git repository. This concern could be mitigated by attaching additional details related to the content (such as original Git source [URL, revision]). Though it should be noted that the GitOps principles only require a source of truth to be visioned and immutable which OCI registires support.
## Alternatives
### Config Management Plugin
Content stored within OCI artifacts could be sourced using a Config Management Plugin which would not require changes to the core capabilities provided by Argo CD. However, this would be hacky and not represent itself within the Argo CD UI.

View File

@@ -1,74 +0,0 @@
---
title: Respect RBAC for Resource Inclusions/Exclusions
authors:
- "@gdsoumya"
- "@alexmt"
sponsors:
- TBD
reviewers:
- @jannfis
approvers:
- @jannfis
creation-date: 2023-05-03
---
# Enhancement Idea
This is a proposal to provide the ability to configure argocd controller, to respect the current RBAC permissions
when handling resources besides the already existing resource inclusions and exclusions.
## Summary
Argo CD administrator will be able to configure in `argocd-cm`, whether to enable or disable(default) the feature where the controller will
only monitor resources that the current service account allows it to read.
## Motivation
Some users restrict the access of the argocd to specific resources using rbac and this feature will enable them to continue
using argocd without having to manually configure resource exclusions for all the resources that they don't want argocd to be managing.
## Proposal
The configuration for this will be present in the `argocd-cm`, we will add new boolean field `resource.respectRBAC` in the
cm which can be set to `true` to enable this feature, by default the feature is disabled.
For the implementation there are 3 proposals :
1. Modify `gitops-engine` pkg to make a `SelfSubjectAccessReview` request before adding any resource to the watch list, in this approach we are making an extra
api server call to check if controller has access to the resource, this does increase the no. of kubeapi calls made but is more accurate.
2. Modify `gitops-engine` pkg to check for forbidden/unauthorized errors when listing for resources, this is more efficient approach as the
no. of kubeapi calls made does not change, but there is a chance of false positives as similar errors can be returned from kubeapi server or env specific proxies in other situations
3. Combine approaches 1 and 2, in this controller will check the api response for the list call, and if it receives forbidden/unauthorized it will make the `SelfSubjectAccessReview` call.
This approach is accurate and at the same time, only makes extra api calls if the list calls fail in the first place.
In all solutions, once controller determines that it does not have access to the resource it will stop monitoring it.
### Implementation decision
It was decided that we will go with approach 3 from the above list, but instead of a boolean flag we will have the `resource.respectRBAC` take 3 configuration options for the users :
- `strict` : This will perform both the checks i.e. whether the list call response is forbidden/unauthorized and if it is make the `SelfSubjectAccessReview` call to confirm.
- `normal` : This will only check whether the list call response is forbidden/unauthorized and skip `SelfSubjectAccessReview` call.
- unset/empty : This will disable the feature and controller will continue to monitor all resources.
NOTE: By default `resource.respectRBAC` will be unset or `""` which disables the feature
Users who are okay with an increase in kube api server calls can opt for strict option while users who are concerned with higher api calls can compromise on the accuracy and opt for the normal option.
## Security Considerations and Risks
There are no particular security risks associated with this change, this proposal rather improves the argocd controller
to not access/monitor resources that it does not have permission to access.
## Upgrade / Downgrade Strategy
There is no special upgrade strategy needed, all existing argocd configmaps will continue to work
and old configs without the `resource.respectRBAC` config will cause no change in argocd controllers behavior.
While downgrading to older version, if the user had configured `resource.respectRBAC` previously this would be ignored completely
and argocd would revert to its default behavior of trying to monitor all resources.

View File

@@ -1,6 +1,6 @@
mkdocs==1.3.0
mkdocs-material==7.1.8
markdown_include==0.6.0
pygments==2.15.0
pygments==2.7.4
jinja2==3.0.3
markdown==3.3.7

View File

@@ -13,63 +13,50 @@ recent minor releases.
| | Critical | High | Medium | Low |
|---:|:--------:|:----:|:------:|:---:|
| [go.mod](master/argocd-test.html) | 0 | 1 | 0 | 0 |
| [ui/yarn.lock](master/argocd-test.html) | 0 | 0 | 0 | 0 |
| [dex:v2.37.0](master/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 2 | 1 |
| [haproxy:2.6.14-alpine](master/haproxy_2.6.14-alpine.html) | 0 | 0 | 2 | 1 |
| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 1 | 15 |
| [redis:7.0.11-alpine](master/redis_7.0.11-alpine.html) | 0 | 0 | 2 | 1 |
| [go.mod](master/argocd-test.html) | 0 | 0 | 0 | 0 |
| [ui/yarn.lock](master/argocd-test.html) | 0 | 0 | 1 | 0 |
| [dex:v2.36.0](master/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 |
| [haproxy:2.6.14-alpine](master/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 |
| [argocd:latest](master/quay.io_argoproj_argocd_latest.html) | 0 | 0 | 0 | 17 |
| [redis:7.0.11-alpine](master/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 |
| [install.yaml](master/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](master/argocd-iac-namespace-install.html) | - | - | - | - |
### v2.8.0-rc7
### v2.7.6
| | Critical | High | Medium | Low |
|---:|:--------:|:----:|:------:|:---:|
| [go.mod](v2.8.0-rc7/argocd-test.html) | 0 | 1 | 0 | 0 |
| [ui/yarn.lock](v2.8.0-rc7/argocd-test.html) | 0 | 0 | 0 | 0 |
| [dex:v2.37.0](v2.8.0-rc7/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 2 | 1 |
| [haproxy:2.6.14-alpine](v2.8.0-rc7/haproxy_2.6.14-alpine.html) | 0 | 0 | 2 | 1 |
| [argocd:v2.8.0-rc7](v2.8.0-rc7/quay.io_argoproj_argocd_v2.8.0-rc7.html) | 0 | 0 | 1 | 15 |
| [redis:7.0.11-alpine](v2.8.0-rc7/redis_7.0.11-alpine.html) | 0 | 0 | 2 | 1 |
| [install.yaml](v2.8.0-rc7/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.8.0-rc7/argocd-iac-namespace-install.html) | - | - | - | - |
| [go.mod](v2.7.6/argocd-test.html) | 0 | 0 | 0 | 0 |
| [ui/yarn.lock](v2.7.6/argocd-test.html) | 0 | 0 | 1 | 0 |
| [dex:v2.36.0](v2.7.6/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 |
| [haproxy:2.6.14-alpine](v2.7.6/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 |
| [argocd:v2.7.6](v2.7.6/quay.io_argoproj_argocd_v2.7.6.html) | 0 | 0 | 0 | 17 |
| [redis:7.0.11-alpine](v2.7.6/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 |
| [install.yaml](v2.7.6/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.7.6/argocd-iac-namespace-install.html) | - | - | - | - |
### v2.7.10
### v2.6.11
| | Critical | High | Medium | Low |
|---:|:--------:|:----:|:------:|:---:|
| [go.mod](v2.7.10/argocd-test.html) | 0 | 0 | 0 | 0 |
| [ui/yarn.lock](v2.7.10/argocd-test.html) | 0 | 1 | 0 | 0 |
| [dex:v2.37.0](v2.7.10/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 2 | 1 |
| [haproxy:2.6.14-alpine](v2.7.10/haproxy_2.6.14-alpine.html) | 0 | 0 | 2 | 1 |
| [argocd:v2.7.10](v2.7.10/quay.io_argoproj_argocd_v2.7.10.html) | 0 | 0 | 1 | 15 |
| [redis:7.0.11-alpine](v2.7.10/redis_7.0.11-alpine.html) | 0 | 0 | 2 | 1 |
| [install.yaml](v2.7.10/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.7.10/argocd-iac-namespace-install.html) | - | - | - | - |
| [go.mod](v2.6.11/argocd-test.html) | 0 | 0 | 0 | 0 |
| [ui/yarn.lock](v2.6.11/argocd-test.html) | 0 | 0 | 1 | 0 |
| [dex:v2.36.0](v2.6.11/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 |
| [haproxy:2.6.14-alpine](v2.6.11/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 |
| [argocd:v2.6.11](v2.6.11/quay.io_argoproj_argocd_v2.6.11.html) | 0 | 0 | 0 | 17 |
| [redis:7.0.11-alpine](v2.6.11/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 |
| [install.yaml](v2.6.11/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.6.11/argocd-iac-namespace-install.html) | - | - | - | - |
### v2.6.13
### v2.5.19
| | Critical | High | Medium | Low |
|---:|:--------:|:----:|:------:|:---:|
| [go.mod](v2.6.13/argocd-test.html) | 0 | 0 | 0 | 0 |
| [ui/yarn.lock](v2.6.13/argocd-test.html) | 0 | 1 | 0 | 0 |
| [dex:v2.37.0](v2.6.13/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 2 | 1 |
| [haproxy:2.6.14-alpine](v2.6.13/haproxy_2.6.14-alpine.html) | 0 | 0 | 2 | 1 |
| [argocd:v2.6.13](v2.6.13/quay.io_argoproj_argocd_v2.6.13.html) | 0 | 0 | 2 | 15 |
| [redis:7.0.11-alpine](v2.6.13/redis_7.0.11-alpine.html) | 0 | 0 | 2 | 1 |
| [install.yaml](v2.6.13/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.6.13/argocd-iac-namespace-install.html) | - | - | - | - |
### v2.5.21
| | Critical | High | Medium | Low |
|---:|:--------:|:----:|:------:|:---:|
| [go.mod](v2.5.21/argocd-test.html) | 0 | 0 | 2 | 0 |
| [ui/yarn.lock](v2.5.21/argocd-test.html) | 0 | 1 | 4 | 0 |
| [dex:v2.37.0](v2.5.21/ghcr.io_dexidp_dex_v2.37.0.html) | 0 | 0 | 2 | 1 |
| [haproxy:2.6.14-alpine](v2.5.21/haproxy_2.6.14-alpine.html) | 0 | 0 | 2 | 1 |
| [argocd:v2.5.21](v2.5.21/quay.io_argoproj_argocd_v2.5.21.html) | 0 | 0 | 2 | 15 |
| [redis:7.0.11-alpine](v2.5.21/redis_7.0.11-alpine.html) | 0 | 0 | 2 | 1 |
| [install.yaml](v2.5.21/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.5.21/argocd-iac-namespace-install.html) | - | - | - | - |
| [go.mod](v2.5.19/argocd-test.html) | 0 | 0 | 2 | 0 |
| [ui/yarn.lock](v2.5.19/argocd-test.html) | 0 | 0 | 5 | 0 |
| [dex:v2.36.0](v2.5.19/ghcr.io_dexidp_dex_v2.36.0.html) | 0 | 2 | 3 | 0 |
| [haproxy:2.6.14-alpine](v2.5.19/haproxy_2.6.14-alpine.html) | 0 | 0 | 0 | 0 |
| [argocd:v2.5.19](v2.5.19/quay.io_argoproj_argocd_v2.5.19.html) | 0 | 0 | 0 | 17 |
| [redis:7.0.11-alpine](v2.5.19/redis_7.0.11-alpine.html) | 0 | 0 | 0 | 0 |
| [install.yaml](v2.5.19/argocd-iac-install.html) | - | - | - | - |
| [namespace-install.yaml](v2.5.19/argocd-iac-namespace-install.html) | - | - | - | - |

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:16:29 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:20:31 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
@@ -507,7 +507,7 @@
</li>
<li class="card__meta__item">
Line number: 18472
Line number: 17965
</li>
</ul>
@@ -553,7 +553,7 @@
</li>
<li class="card__meta__item">
Line number: 18549
Line number: 18042
</li>
</ul>
@@ -599,7 +599,7 @@
</li>
<li class="card__meta__item">
Line number: 18577
Line number: 18070
</li>
</ul>
@@ -645,7 +645,7 @@
</li>
<li class="card__meta__item">
Line number: 18625
Line number: 18118
</li>
</ul>
@@ -691,7 +691,7 @@
</li>
<li class="card__meta__item">
Line number: 18607
Line number: 18100
</li>
</ul>
@@ -737,7 +737,7 @@
</li>
<li class="card__meta__item">
Line number: 18641
Line number: 18134
</li>
</ul>
@@ -789,7 +789,7 @@
</li>
<li class="card__meta__item">
Line number: 19737
Line number: 19218
</li>
</ul>
@@ -847,7 +847,7 @@
</li>
<li class="card__meta__item">
Line number: 19112
Line number: 18605
</li>
</ul>
@@ -905,7 +905,7 @@
</li>
<li class="card__meta__item">
Line number: 19345
Line number: 18826
</li>
</ul>
@@ -963,7 +963,7 @@
</li>
<li class="card__meta__item">
Line number: 19311
Line number: 18792
</li>
</ul>
@@ -1021,7 +1021,7 @@
</li>
<li class="card__meta__item">
Line number: 19405
Line number: 18886
</li>
</ul>
@@ -1079,7 +1079,7 @@
</li>
<li class="card__meta__item">
Line number: 19492
Line number: 18973
</li>
</ul>
@@ -1137,7 +1137,7 @@
</li>
<li class="card__meta__item">
Line number: 19737
Line number: 19218
</li>
</ul>
@@ -1195,7 +1195,7 @@
</li>
<li class="card__meta__item">
Line number: 19549
Line number: 19030
</li>
</ul>
@@ -1253,7 +1253,7 @@
</li>
<li class="card__meta__item">
Line number: 19822
Line number: 19303
</li>
</ul>
@@ -1311,7 +1311,7 @@
</li>
<li class="card__meta__item">
Line number: 20138
Line number: 19619
</li>
</ul>
@@ -1363,7 +1363,7 @@
</li>
<li class="card__meta__item">
Line number: 19325
Line number: 18806
</li>
</ul>
@@ -1415,7 +1415,7 @@
</li>
<li class="card__meta__item">
Line number: 19112
Line number: 18605
</li>
</ul>
@@ -1467,7 +1467,7 @@
</li>
<li class="card__meta__item">
Line number: 19311
Line number: 18792
</li>
</ul>
@@ -1519,7 +1519,7 @@
</li>
<li class="card__meta__item">
Line number: 19345
Line number: 18826
</li>
</ul>
@@ -1571,7 +1571,7 @@
</li>
<li class="card__meta__item">
Line number: 19492
Line number: 18973
</li>
</ul>
@@ -1623,7 +1623,7 @@
</li>
<li class="card__meta__item">
Line number: 19737
Line number: 19218
</li>
</ul>
@@ -1681,7 +1681,7 @@
</li>
<li class="card__meta__item">
Line number: 19112
Line number: 18605
</li>
</ul>
@@ -1739,7 +1739,7 @@
</li>
<li class="card__meta__item">
Line number: 19311
Line number: 18792
</li>
</ul>
@@ -1797,7 +1797,7 @@
</li>
<li class="card__meta__item">
Line number: 19345
Line number: 18826
</li>
</ul>
@@ -1855,7 +1855,7 @@
</li>
<li class="card__meta__item">
Line number: 19405
Line number: 18886
</li>
</ul>
@@ -1913,7 +1913,7 @@
</li>
<li class="card__meta__item">
Line number: 19492
Line number: 18973
</li>
</ul>
@@ -1971,7 +1971,7 @@
</li>
<li class="card__meta__item">
Line number: 19737
Line number: 19218
</li>
</ul>
@@ -2029,7 +2029,7 @@
</li>
<li class="card__meta__item">
Line number: 19549
Line number: 19030
</li>
</ul>
@@ -2087,7 +2087,7 @@
</li>
<li class="card__meta__item">
Line number: 19822
Line number: 19303
</li>
</ul>
@@ -2145,7 +2145,7 @@
</li>
<li class="card__meta__item">
Line number: 20138
Line number: 19619
</li>
</ul>
@@ -2201,7 +2201,7 @@
</li>
<li class="card__meta__item">
Line number: 19235
Line number: 18716
</li>
</ul>
@@ -2257,7 +2257,7 @@
</li>
<li class="card__meta__item">
Line number: 19353
Line number: 18834
</li>
</ul>
@@ -2313,7 +2313,7 @@
</li>
<li class="card__meta__item">
Line number: 19328
Line number: 18809
</li>
</ul>
@@ -2369,7 +2369,7 @@
</li>
<li class="card__meta__item">
Line number: 19426
Line number: 18907
</li>
</ul>
@@ -2425,7 +2425,7 @@
</li>
<li class="card__meta__item">
Line number: 19502
Line number: 18983
</li>
</ul>
@@ -2481,7 +2481,7 @@
</li>
<li class="card__meta__item">
Line number: 19744
Line number: 19225
</li>
</ul>
@@ -2537,7 +2537,7 @@
</li>
<li class="card__meta__item">
Line number: 19710
Line number: 19191
</li>
</ul>
@@ -2593,7 +2593,7 @@
</li>
<li class="card__meta__item">
Line number: 20048
Line number: 19529
</li>
</ul>
@@ -2649,7 +2649,7 @@
</li>
<li class="card__meta__item">
Line number: 20286
Line number: 19767
</li>
</ul>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:16:42 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:20:44 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
@@ -789,7 +789,7 @@
</li>
<li class="card__meta__item">
Line number: 1249
Line number: 1237
</li>
</ul>
@@ -905,7 +905,7 @@
</li>
<li class="card__meta__item">
Line number: 857
Line number: 845
</li>
</ul>
@@ -963,7 +963,7 @@
</li>
<li class="card__meta__item">
Line number: 823
Line number: 811
</li>
</ul>
@@ -1021,7 +1021,7 @@
</li>
<li class="card__meta__item">
Line number: 917
Line number: 905
</li>
</ul>
@@ -1079,7 +1079,7 @@
</li>
<li class="card__meta__item">
Line number: 1004
Line number: 992
</li>
</ul>
@@ -1137,7 +1137,7 @@
</li>
<li class="card__meta__item">
Line number: 1249
Line number: 1237
</li>
</ul>
@@ -1195,7 +1195,7 @@
</li>
<li class="card__meta__item">
Line number: 1061
Line number: 1049
</li>
</ul>
@@ -1253,7 +1253,7 @@
</li>
<li class="card__meta__item">
Line number: 1334
Line number: 1322
</li>
</ul>
@@ -1311,7 +1311,7 @@
</li>
<li class="card__meta__item">
Line number: 1650
Line number: 1638
</li>
</ul>
@@ -1363,7 +1363,7 @@
</li>
<li class="card__meta__item">
Line number: 837
Line number: 825
</li>
</ul>
@@ -1467,7 +1467,7 @@
</li>
<li class="card__meta__item">
Line number: 823
Line number: 811
</li>
</ul>
@@ -1519,7 +1519,7 @@
</li>
<li class="card__meta__item">
Line number: 857
Line number: 845
</li>
</ul>
@@ -1571,7 +1571,7 @@
</li>
<li class="card__meta__item">
Line number: 1004
Line number: 992
</li>
</ul>
@@ -1623,7 +1623,7 @@
</li>
<li class="card__meta__item">
Line number: 1249
Line number: 1237
</li>
</ul>
@@ -1739,7 +1739,7 @@
</li>
<li class="card__meta__item">
Line number: 823
Line number: 811
</li>
</ul>
@@ -1797,7 +1797,7 @@
</li>
<li class="card__meta__item">
Line number: 857
Line number: 845
</li>
</ul>
@@ -1855,7 +1855,7 @@
</li>
<li class="card__meta__item">
Line number: 917
Line number: 905
</li>
</ul>
@@ -1913,7 +1913,7 @@
</li>
<li class="card__meta__item">
Line number: 1004
Line number: 992
</li>
</ul>
@@ -1971,7 +1971,7 @@
</li>
<li class="card__meta__item">
Line number: 1249
Line number: 1237
</li>
</ul>
@@ -2029,7 +2029,7 @@
</li>
<li class="card__meta__item">
Line number: 1061
Line number: 1049
</li>
</ul>
@@ -2087,7 +2087,7 @@
</li>
<li class="card__meta__item">
Line number: 1334
Line number: 1322
</li>
</ul>
@@ -2145,7 +2145,7 @@
</li>
<li class="card__meta__item">
Line number: 1650
Line number: 1638
</li>
</ul>
@@ -2201,7 +2201,7 @@
</li>
<li class="card__meta__item">
Line number: 747
Line number: 735
</li>
</ul>
@@ -2257,7 +2257,7 @@
</li>
<li class="card__meta__item">
Line number: 865
Line number: 853
</li>
</ul>
@@ -2313,7 +2313,7 @@
</li>
<li class="card__meta__item">
Line number: 840
Line number: 828
</li>
</ul>
@@ -2369,7 +2369,7 @@
</li>
<li class="card__meta__item">
Line number: 938
Line number: 926
</li>
</ul>
@@ -2425,7 +2425,7 @@
</li>
<li class="card__meta__item">
Line number: 1014
Line number: 1002
</li>
</ul>
@@ -2481,7 +2481,7 @@
</li>
<li class="card__meta__item">
Line number: 1256
Line number: 1244
</li>
</ul>
@@ -2537,7 +2537,7 @@
</li>
<li class="card__meta__item">
Line number: 1222
Line number: 1210
</li>
</ul>
@@ -2593,7 +2593,7 @@
</li>
<li class="card__meta__item">
Line number: 1560
Line number: 1548
</li>
</ul>
@@ -2649,7 +2649,7 @@
</li>
<li class="card__meta__item">
Line number: 1798
Line number: 1786
</li>
</ul>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:14:07 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:17:47 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following paths:</span>
@@ -468,7 +468,7 @@
<div class="meta-counts">
<div class="meta-count"><span>1</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>1 vulnerable dependency paths</span></div>
<div class="meta-count"><span>1859</span> <span>dependencies</span></div>
<div class="meta-count"><span>1799</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
@@ -476,30 +476,30 @@
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
<h2 class="card__title">Denial of Service (DoS)</h2>
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Regular Expression Denial of Service (ReDoS)</h2>
<div class="card__section">
<div class="label label--high">
<span class="label__text">high severity</span>
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: golang
Package Manager: npm
</li>
<li class="card__meta__item">
Vulnerable module:
nhooyr.io/websocket
semver
</li>
<li class="card__meta__item">Introduced through:
github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others
argo-cd-ui@1.0.0, superagent@8.0.9 and others
</li>
</ul>
@@ -511,11 +511,11 @@
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
github.com/argoproj/argo-cd/v2@0.0.0
argo-cd-ui@1.0.0
<span class="list-paths__item__arrow"></span>
github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0
superagent@8.0.9
<span class="list-paths__item__arrow"></span>
nhooyr.io/websocket@1.8.6
semver@7.3.8
</span>
@@ -527,34 +527,102 @@
<hr/>
<!-- Overview -->
<h2 id="overview">Overview</h2>
<p><a href="https://github.com/nhooyr/websocket">nhooyr.io/websocket</a> is a minimal and idiomatic WebSocket library for Go.</p>
<p>Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping.
If the second pong arrived before the ping <code>goroutine</code> deleted its channel from the map, the channel would be closed twice and a panic would
occur.</p>
<p><a href="https://github.com/npm/node-semver">semver</a> is a semantic version parser used by npm.</p>
<p>Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the function <code>new Range</code>, when untrusted user data is provided as a range.</p>
<h2 id="poc">PoC</h2>
<pre><code class="language-js">
const semver = require(&#39;semver&#39;)
const lengths_2 = [2000, 4000, 8000, 16000, 32000, 64000, 128000]
console.log(&quot;n[+] Valid range - Test payloads&quot;)
for (let i = 0; i =1.2.3&#39; + &#39; &#39;.repeat(lengths_2[i]) + &#39;&lt;1.3.0&#39;;
const start = Date.now()
semver.validRange(value)
// semver.minVersion(value)
// semver.maxSatisfying([&quot;1.2.3&quot;], value)
// semver.minSatisfying([&quot;1.2.3&quot;], value)
// new semver.Range(value, {})
const end = Date.now();
console.log(&#39;length=%d, time=%d ms&#39;, value.length, end - start);
}
</code></pre>
<h2 id="details">Details</h2>
<p>Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.</p>
<p>Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.</p>
<p>One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.</p>
<p>When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.</p>
<p>Two common types of DoS vulnerabilities:</p>
<p>Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.</p>
<p>The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren&#39;t very intuitive and can ultimately end up making it easy for attackers to take your site down.</p>
<p>Lets take the following regular expression as an example:</p>
<pre><code class="language-js">regex = /A(B|C+)+D/
</code></pre>
<p>This regular expression accomplishes the following:</p>
<ul>
<li><p>High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, <a href="SNYK-JAVA-COMMONSFILEUPLOAD-30082">commons-fileupload:commons-fileupload</a>.</p>
</li>
<li><p>Crash - An attacker sending crafted requests that could cause the system to crash. For Example, <a href="https://snyk.io/vuln/npm:ws:20171108">npm <code>ws</code> package</a></p>
</li>
<li><code>A</code> The string must start with the letter &#39;A&#39;</li>
<li><code>(B|C+)+</code> The string must then follow the letter A with either the letter &#39;B&#39; or some number of occurrences of the letter &#39;C&#39; (the <code>+</code> matches one or more times). The <code>+</code> at the end of this section states that we can look for one or more matches of this section.</li>
<li><code>D</code> Finally, we ensure this section of the string ends with a &#39;D&#39;</li>
</ul>
<p>The expression would match inputs such as <code>ABBD</code>, <code>ABCCCCD</code>, <code>ABCBCCCD</code> and <code>ACCCCCD</code></p>
<p>It most cases, it doesn&#39;t take very long for a regex engine to find a match:</p>
<pre><code class="language-bash">$ time node -e &#39;/A(B|C+)+D/.test(&quot;ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD&quot;)&#39;
0.04s user 0.01s system 95% cpu 0.052 total
$ time node -e &#39;/A(B|C+)+D/.test(&quot;ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX&quot;)&#39;
1.79s user 0.02s system 99% cpu 1.812 total
</code></pre>
<p>The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.</p>
<p>Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesnt match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as <em>catastrophic backtracking</em>.</p>
<p>Let&#39;s look at how our expression runs into this problem, using a shorter string: &quot;ACCCX&quot;. While it seems fairly straightforward, there are still four different ways that the engine could match those three C&#39;s:</p>
<ol>
<li>CCC</li>
<li>CC+C</li>
<li>C+CC</li>
<li>C+C+C.</li>
</ol>
<p>The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use <a href="https://regex101.com/debugger">RegEx 101 debugger</a> to see the engine has to take a total of 38 steps before it can determine the string doesn&#39;t match.</p>
<p>From there, the number of steps the engine must use to validate a string just continues to grow.</p>
<table>
<thead>
<tr>
<th>String</th>
<th align="right">Number of C&#39;s</th>
<th align="right">Number of steps</th>
</tr>
</thead>
<tbody><tr>
<td>ACCCX</td>
<td align="right">3</td>
<td align="right">38</td>
</tr>
<tr>
<td>ACCCCX</td>
<td align="right">4</td>
<td align="right">71</td>
</tr>
<tr>
<td>ACCCCCX</td>
<td align="right">5</td>
<td align="right">136</td>
</tr>
<tr>
<td>ACCCCCCCCCCCCCCX</td>
<td align="right">14</td>
<td align="right">65,553</td>
</tr>
</tbody></table>
<p>By the time the string includes 14 C&#39;s, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>nhooyr.io/websocket</code> to version 1.8.7 or higher.</p>
<p>Upgrade <code>semver</code> to version 7.5.2 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/nhooyr/websocket/commit/3604edcb857415cb2c1213d63328cdcd738f2328">GitHub Commit</a></li>
<li><a href="https://github.com/nhooyr/websocket/pull/291">GitHub PR</a></li>
<li><a href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/pull/564">GitHub PR</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104">Vulnerable Code</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/internal/re.js#L138">Vulnerable Code</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/internal/re.js#L160">Vulnerable Code</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-GOLANG-NHOOYRIOWEBSOCKET-1244972">More about this vulnerability</a></p>
<p><a href="https://snyk.io/vuln/SNYK-JS-SEMVER-3247795">More about this vulnerability</a></p>
</div>
</div><!-- .card -->

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="3 known vulnerabilities found in 27 vulnerable dependency paths.">
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:14:24 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:18:06 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
@@ -466,8 +466,8 @@
</div>
<div class="meta-counts">
<div class="meta-count"><span>3</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>27 vulnerable dependency paths</span></div>
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
@@ -484,546 +484,7 @@
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Improper Authentication</h2>
<div class="card__section">
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: alpine:3.18
</li>
<li class="card__meta__item">
Vulnerable module:
openssl/libcrypto3
</li>
<li class="card__meta__item">Introduced through:
docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.1-r1
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Alpine:3.18</code>.</em>
<em>See <code>How to fix?</code> for <code>Alpine:3.18</code> relevant fixed versions and status.</em></p>
<p>Issue summary: The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequence.</p>
<p>Impact summary: Applications that use the AES-SIV algorithm and want to
authenticate empty data entries as associated data can be mislead by removing
adding or reordering such empty entries as these are ignored by the OpenSSL
implementation. We are currently unaware of any such applications.</p>
<p>The AES-SIV algorithm allows for authentication of multiple associated
data entries along with the encryption. To authenticate empty data the
application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with
NULL pointer as the output buffer and 0 as the input buffer length.
The AES-SIV implementation in OpenSSL just returns success for such a call
instead of performing the associated data authentication operation.
The empty data thus will not be authenticated.</p>
<p>As this issue does not affect non-empty associated data authentication and
we expect it to be rare for an application to use empty associated data
entries this is qualified as Low severity issue.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>Alpine:3.18</code> <code>openssl</code> to version 3.1.1-r2 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230714.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/15/1">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/5">openssl-security@openssl.org</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230725-0004/">openssl-security@openssl.org</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5776808">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Inefficient Regular Expression Complexity</h2>
<div class="card__section">
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: alpine:3.18
</li>
<li class="card__meta__item">
Vulnerable module:
openssl/libcrypto3
</li>
<li class="card__meta__item">Introduced through:
docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.1-r1
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Alpine:3.18</code>.</em>
<em>See <code>How to fix?</code> for <code>Alpine:3.18</code> relevant fixed versions and status.</em></p>
<p>Issue summary: Checking excessively long DH keys or parameters may be very slow.</p>
<p>Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.</p>
<p>The function DH_check() performs various checks on DH parameters. One of those
checks confirms that the modulus (&#39;p&#39; parameter) is not too large. Trying to use
a very large modulus is slow and OpenSSL will not normally use a modulus which
is over 10,000 bits in length.</p>
<p>However the DH_check() function checks numerous aspects of the key or parameters
that have been supplied. Some of those checks use the supplied modulus value
even if it has already been found to be too large.</p>
<p>An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulernable to a Denial of Service attack.</p>
<p>The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().</p>
<p>Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the &#39;-check&#39; option.</p>
<p>The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>Alpine:3.18</code> <code>openssl</code> to version 3.1.1-r3 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230719.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/4">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/5">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/6">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/31/1">openssl-security@openssl.org</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230803-0011/">openssl-security@openssl.org</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5788370">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">CVE-2023-3817</h2>
<div class="card__section">
<div class="label label--low">
<span class="label__text">low severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: alpine:3.18
</li>
<li class="card__meta__item">
Vulnerable module:
openssl/libcrypto3
</li>
<li class="card__meta__item">Introduced through:
docker-image|haproxy@2.6.14-alpine and openssl/libcrypto3@3.1.1-r1
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
.haproxy-rundeps@20230615.052124
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|haproxy@2.6.14-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Alpine:3.18</code>.</em>
<em>See <code>How to fix?</code> for <code>Alpine:3.18</code> relevant fixed versions and status.</em></p>
<p>Issue summary: Checking excessively long DH keys or parameters may be very slow.</p>
<p>Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.</p>
<p>The function DH_check() performs various checks on DH parameters. After fixing
CVE-2023-3446 it was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A correct q value,
if present, cannot be larger than the modulus p parameter, thus it is
unnecessary to perform these checks if q is larger than p.</p>
<p>An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulnerable to a Denial of Service attack.</p>
<p>The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().</p>
<p>Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the &#34;-check&#34; option.</p>
<p>The OpenSSL SSL/TLS implementation is not affected by this issue.</p>
<p>The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>Alpine:3.18</code> <code>openssl</code> to version 3.1.2-r0 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230731.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/31/1">openssl-security@openssl.org</a></li>
<li><a href="http://seclists.org/fulldisclosure/2023/Jul/43">openssl-security@openssl.org</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5821142">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
</div><!-- cards -->
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="17 known vulnerabilities found in 74 vulnerable dependency paths.">
<meta name="description" content="17 known vulnerabilities found in 64 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:14:47 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:18:33 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following paths:</span>
@@ -467,8 +467,8 @@
<div class="meta-counts">
<div class="meta-count"><span>17</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>74 vulnerable dependency paths</span></div>
<div class="meta-count"><span>2126</span> <span>dependencies</span></div>
<div class="meta-count"><span>64 vulnerable dependency paths</span></div>
<div class="meta-count"><span>2108</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
@@ -476,173 +476,6 @@
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
<h2 class="card__title">Denial of Service (DoS)</h2>
<div class="card__section">
<div class="label label--high">
<span class="label__text">high severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: golang
</li>
<li class="card__meta__item">
Vulnerable module:
nhooyr.io/websocket
</li>
<li class="card__meta__item">Introduced through:
github.com/argoproj/argo-cd/v2@* and nhooyr.io/websocket@v1.8.6
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
github.com/argoproj/argo-cd/v2@*
<span class="list-paths__item__arrow"></span>
nhooyr.io/websocket@v1.8.6
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="overview">Overview</h2>
<p><a href="https://github.com/nhooyr/websocket">nhooyr.io/websocket</a> is a minimal and idiomatic WebSocket library for Go.</p>
<p>Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping.
If the second pong arrived before the ping <code>goroutine</code> deleted its channel from the map, the channel would be closed twice and a panic would
occur.</p>
<h2 id="details">Details</h2>
<p>Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.</p>
<p>Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.</p>
<p>One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.</p>
<p>When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.</p>
<p>Two common types of DoS vulnerabilities:</p>
<ul>
<li><p>High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, <a href="SNYK-JAVA-COMMONSFILEUPLOAD-30082">commons-fileupload:commons-fileupload</a>.</p>
</li>
<li><p>Crash - An attacker sending crafted requests that could cause the system to crash. For Example, <a href="https://snyk.io/vuln/npm:ws:20171108">npm <code>ws</code> package</a></p>
</li>
</ul>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>nhooyr.io/websocket</code> to version 1.8.7 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/nhooyr/websocket/commit/3604edcb857415cb2c1213d63328cdcd738f2328">GitHub Commit</a></li>
<li><a href="https://github.com/nhooyr/websocket/pull/291">GitHub PR</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-GOLANG-NHOOYRIOWEBSOCKET-1244972">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">CVE-2023-4016</h2>
<div class="card__section">
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: ubuntu:22.04
</li>
<li class="card__meta__item">
Vulnerable module:
procps/libprocps8
</li>
<li class="card__meta__item">Introduced through:
docker-image|quay.io/argoproj/argocd@latest and procps/libprocps8@2:3.3.17-6ubuntu2
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
procps/libprocps8@2:3.3.17-6ubuntu2
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
procps@2:3.3.17-6ubuntu2
<span class="list-paths__item__arrow"></span>
procps/libprocps8@2:3.3.17-6ubuntu2
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
procps@2:3.3.17-6ubuntu2
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>procps</code> package and not the <code>procps</code> package as distributed by <code>Ubuntu:22.04</code>.</em>
<em>See <code>How to fix?</code> for <code>Ubuntu:22.04</code> relevant fixed versions and status.</em></p>
<p>Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.</p>
<h2 id="remediation">Remediation</h2>
<p>There is no fixed version for <code>Ubuntu:22.04</code> <code>procps</code>.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-4016">ADVISORY</a></li>
<li><a href="https://gitlab.com/procps-ng/procps">trellixpsirt@trellix.com</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2204-PROCPS-5816665">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">CVE-2022-46908</h2>
<div class="card__section">
@@ -772,7 +605,7 @@
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openssh/openssh-client@1:8.9p1-3ubuntu0.3
openssh/openssh-client@1:8.9p1-3ubuntu0.1
<span class="list-paths__item__arrow"></span>
shadow/passwd@1:4.8.1-2ubuntu2.1
@@ -1040,7 +873,7 @@
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">Improper Authentication</h2>
<h2 class="card__title">Information Exposure</h2>
<div class="card__section">
<div class="label label--low">
@@ -1056,12 +889,12 @@
<li class="card__meta__item">
Vulnerable module:
openssl/libssl3
openssh/openssh-client
</li>
<li class="card__meta__item">Introduced through:
docker-image|quay.io/argoproj/argocd@latest and openssl/libssl3@3.0.2-0ubuntu1.10
docker-image|quay.io/argoproj/argocd@latest and openssh/openssh-client@1:8.9p1-3ubuntu0.1
</li>
</ul>
@@ -1076,111 +909,7 @@
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1.2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
libfido2/libfido2-1@1.10.0-1
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openssh/openssh-client@1:8.9p1-3ubuntu0.3
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
ca-certificates@20230311ubuntu0.22.04.1
<span class="list-paths__item__arrow"></span>
openssl@3.0.2-0ubuntu1.10
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
git@1:2.34.1-1ubuntu1.9
<span class="list-paths__item__arrow"></span>
curl/libcurl3-gnutls@7.81.0-1ubuntu1.13
<span class="list-paths__item__arrow"></span>
libssh/libssh-4@0.9.6-2ubuntu0.22.04.1
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
adduser@3.118ubuntu5
<span class="list-paths__item__arrow"></span>
shadow/passwd@1:4.8.1-2ubuntu2.1
<span class="list-paths__item__arrow"></span>
pam/libpam-modules@1.4.0-11ubuntu2.3
<span class="list-paths__item__arrow"></span>
libnsl/libnsl2@1.3.0-2build2
<span class="list-paths__item__arrow"></span>
libtirpc/libtirpc3@1.3.2-2ubuntu0.1
<span class="list-paths__item__arrow"></span>
krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
<span class="list-paths__item__arrow"></span>
krb5/libkrb5-3@1.19.2-2ubuntu0.2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openssl@3.0.2-0ubuntu1.10
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
ca-certificates@20230311ubuntu0.22.04.1
<span class="list-paths__item__arrow"></span>
openssl@3.0.2-0ubuntu1.10
openssh/openssh-client@1:8.9p1-3ubuntu0.1
</span>
@@ -1192,42 +921,28 @@
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Ubuntu:22.04</code>.</em>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssh</code> package and not the <code>openssh</code> package as distributed by <code>Ubuntu:22.04</code>.</em>
<em>See <code>How to fix?</code> for <code>Ubuntu:22.04</code> relevant fixed versions and status.</em></p>
<p>Issue summary: The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequence.</p>
<p>Impact summary: Applications that use the AES-SIV algorithm and want to
authenticate empty data entries as associated data can be mislead by removing
adding or reordering such empty entries as these are ignored by the OpenSSL
implementation. We are currently unaware of any such applications.</p>
<p>The AES-SIV algorithm allows for authentication of multiple associated
data entries along with the encryption. To authenticate empty data the
application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with
NULL pointer as the output buffer and 0 as the input buffer length.
The AES-SIV implementation in OpenSSL just returns success for such a call
instead of performing the associated data authentication operation.
The empty data thus will not be authenticated.</p>
<p>As this issue does not affect non-empty associated data authentication and
we expect it to be rare for an application to use empty associated data
entries this is qualified as Low severity issue.</p>
<p>The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.</p>
<h2 id="remediation">Remediation</h2>
<p>There is no fixed version for <code>Ubuntu:22.04</code> <code>openssl</code>.</p>
<p>There is no fixed version for <code>Ubuntu:22.04</code> <code>openssh</code>.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-2975">ADVISORY</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230714.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/15/1">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/5">openssl-security@openssl.org</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230725-0004/">openssl-security@openssl.org</a></li>
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-14145">ADVISORY</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20200709-0004/">CONFIRM</a></li>
<li><a href="https://security.gentoo.org/glsa/202105-35">GENTOO</a></li>
<li><a href="https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d">MISC</a></li>
<li><a href="https://docs.ssh-mitm.at/CVE-2020-14145.html">MISC</a></li>
<li><a href="https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1">MISC</a></li>
<li><a href="https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py">MISC</a></li>
<li><a href="https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/">MISC</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2020/12/02/1">MLIST</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2204-OPENSSL-5776816">More about this vulnerability</a></p>
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2204-OPENSSH-2792745">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
@@ -1253,7 +968,7 @@
<li class="card__meta__item">Introduced through:
docker-image|quay.io/argoproj/argocd@latest and openssh/openssh-client@1:8.9p1-3ubuntu0.3
docker-image|quay.io/argoproj/argocd@latest and openssh/openssh-client@1:8.9p1-3ubuntu0.1
</li>
</ul>
@@ -1268,7 +983,7 @@
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openssh/openssh-client@1:8.9p1-3ubuntu0.3
openssh/openssh-client@1:8.9p1-3ubuntu0.1
</span>
@@ -1290,7 +1005,6 @@
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-28531">ADVISORY</a></li>
<li><a href="https://www.openwall.com/lists/oss-security/2023/03/15/8">cve@mitre.org</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230413-0008/">cve@mitre.org</a></li>
<li><a href="https://security.gentoo.org/glsa/202307-01">cve@mitre.org</a></li>
</ul>
<hr/>
@@ -1339,7 +1053,7 @@
<span class="list-paths__item__arrow"></span>
gnupg2/dirmngr@2.2.27-3ubuntu2.1
<span class="list-paths__item__arrow"></span>
openldap/libldap-2.5-0@2.5.15+dfsg-0ubuntu0.22.04.1
openldap/libldap-2.5-0@2.5.14+dfsg-0ubuntu0.22.04.2
</span>
@@ -1350,9 +1064,9 @@
<span class="list-paths__item__arrow"></span>
git@1:2.34.1-1ubuntu1.9
<span class="list-paths__item__arrow"></span>
curl/libcurl3-gnutls@7.81.0-1ubuntu1.13
curl/libcurl3-gnutls@7.81.0-1ubuntu1.10
<span class="list-paths__item__arrow"></span>
openldap/libldap-2.5-0@2.5.15+dfsg-0ubuntu0.22.04.1
openldap/libldap-2.5-0@2.5.14+dfsg-0ubuntu0.22.04.2
</span>
@@ -1361,7 +1075,7 @@
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openldap/libldap-common@2.5.15+dfsg-0ubuntu0.22.04.1
openldap/libldap-common@2.5.14+dfsg-0ubuntu0.22.04.2
</span>
@@ -1383,13 +1097,6 @@
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-2953">ADVISORY</a></li>
<li><a href="https://access.redhat.com/security/cve/CVE-2023-2953">secalert@redhat.com</a></li>
<li><a href="https://bugs.openldap.org/show_bug.cgi?id=9904">secalert@redhat.com</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230703-0005/">secalert@redhat.com</a></li>
<li><a href="https://support.apple.com/kb/HT213843">secalert@redhat.com</a></li>
<li><a href="https://support.apple.com/kb/HT213844">secalert@redhat.com</a></li>
<li><a href="https://support.apple.com/kb/HT213845">secalert@redhat.com</a></li>
<li><a href="http://seclists.org/fulldisclosure/2023/Jul/47">secalert@redhat.com</a></li>
<li><a href="http://seclists.org/fulldisclosure/2023/Jul/48">secalert@redhat.com</a></li>
<li><a href="http://seclists.org/fulldisclosure/2023/Jul/52">secalert@redhat.com</a></li>
</ul>
<hr/>
@@ -1459,7 +1166,6 @@
<ul>
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2022-4899">ADVISORY</a></li>
<li><a href="https://github.com/facebook/zstd/issues/3200">secalert@redhat.com</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230725-0005/">secalert@redhat.com</a></li>
</ul>
<hr/>
@@ -1598,7 +1304,7 @@
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
openssh/openssh-client@1:8.9p1-3ubuntu0.3
openssh/openssh-client@1:8.9p1-3ubuntu0.1
<span class="list-paths__item__arrow"></span>
krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
@@ -1611,7 +1317,7 @@
<span class="list-paths__item__arrow"></span>
git@1:2.34.1-1ubuntu1.9
<span class="list-paths__item__arrow"></span>
curl/libcurl3-gnutls@7.81.0-1ubuntu1.13
curl/libcurl3-gnutls@7.81.0-1ubuntu1.10
<span class="list-paths__item__arrow"></span>
krb5/libgssapi-krb5-2@1.19.2-2ubuntu0.2
@@ -1624,7 +1330,7 @@
<span class="list-paths__item__arrow"></span>
git@1:2.34.1-1ubuntu1.9
<span class="list-paths__item__arrow"></span>
curl/libcurl3-gnutls@7.81.0-1ubuntu1.13
curl/libcurl3-gnutls@7.81.0-1ubuntu1.10
<span class="list-paths__item__arrow"></span>
libssh/libssh-4@0.9.6-2ubuntu0.22.04.1
<span class="list-paths__item__arrow"></span>
@@ -2236,6 +1942,150 @@
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2204-GIT-2798113">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">CVE-2023-28322</h2>
<div class="card__section">
<div class="label label--low">
<span class="label__text">low severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: ubuntu:22.04
</li>
<li class="card__meta__item">
Vulnerable module:
curl/libcurl3-gnutls
</li>
<li class="card__meta__item">Introduced through:
docker-image|quay.io/argoproj/argocd@latest, git@1:2.34.1-1ubuntu1.9 and others
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
git@1:2.34.1-1ubuntu1.9
<span class="list-paths__item__arrow"></span>
curl/libcurl3-gnutls@7.81.0-1ubuntu1.10
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu:22.04</code>.</em>
<em>See <code>How to fix?</code> for <code>Ubuntu:22.04</code> relevant fixed versions and status.</em></p>
<p>An information disclosure vulnerability exists in curl &lt;v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (<code>CURLOPT_READFUNCTION</code>) to ask for data to send, even when the <code>CURLOPT_POSTFIELDS</code> option has been set, if the same handle previously wasused to issue a <code>PUT</code> request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.</p>
<h2 id="remediation">Remediation</h2>
<p>There is no fixed version for <code>Ubuntu:22.04</code> <code>curl</code>.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-28322">ADVISORY</a></li>
<li><a href="https://hackerone.com/reports/1954658">support@hackerone.com</a></li>
<li><a href="https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/">support@hackerone.com</a></li>
<li><a href="https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/">support@hackerone.com</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230609-0009/">support@hackerone.com</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2204-CURL-5561923">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">Improper Certificate Validation</h2>
<div class="card__section">
<div class="label label--low">
<span class="label__text">low severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: ubuntu:22.04
</li>
<li class="card__meta__item">
Vulnerable module:
curl/libcurl3-gnutls
</li>
<li class="card__meta__item">Introduced through:
docker-image|quay.io/argoproj/argocd@latest, git@1:2.34.1-1ubuntu1.9 and others
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|quay.io/argoproj/argocd@latest
<span class="list-paths__item__arrow"></span>
git@1:2.34.1-1ubuntu1.9
<span class="list-paths__item__arrow"></span>
curl/libcurl3-gnutls@7.81.0-1ubuntu1.10
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu:22.04</code>.</em>
<em>See <code>How to fix?</code> for <code>Ubuntu:22.04</code> relevant fixed versions and status.</em></p>
<p>An improper certificate validation vulnerability exists in curl &lt;v8.1.0 in the way it supports matching of wildcard patterns when listed as &#34;Subject Alternative Name&#34; in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with <code>xn--</code> and should not be allowed to pattern match, but the wildcard check in curl could still check for <code>x*</code>, which would match even though the IDN name most likely contained nothing even resembling an <code>x</code>.</p>
<h2 id="remediation">Remediation</h2>
<p>There is no fixed version for <code>Ubuntu:22.04</code> <code>curl</code>.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2023-28321">ADVISORY</a></li>
<li><a href="https://hackerone.com/reports/1950627">support@hackerone.com</a></li>
<li><a href="https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/">support@hackerone.com</a></li>
<li><a href="https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/">support@hackerone.com</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230609-0009/">support@hackerone.com</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2204-CURL-5561951">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">Improper Input Validation</h2>

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="3 known vulnerabilities found in 27 vulnerable dependency paths.">
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:14:57 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:18:41 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
@@ -466,8 +466,8 @@
</div>
<div class="meta-counts">
<div class="meta-count"><span>3</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>27 vulnerable dependency paths</span></div>
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
@@ -484,546 +484,7 @@
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Improper Authentication</h2>
<div class="card__section">
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: alpine:3.18
</li>
<li class="card__meta__item">
Vulnerable module:
openssl/libcrypto3
</li>
<li class="card__meta__item">Introduced through:
docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Alpine:3.18</code>.</em>
<em>See <code>How to fix?</code> for <code>Alpine:3.18</code> relevant fixed versions and status.</em></p>
<p>Issue summary: The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequence.</p>
<p>Impact summary: Applications that use the AES-SIV algorithm and want to
authenticate empty data entries as associated data can be mislead by removing
adding or reordering such empty entries as these are ignored by the OpenSSL
implementation. We are currently unaware of any such applications.</p>
<p>The AES-SIV algorithm allows for authentication of multiple associated
data entries along with the encryption. To authenticate empty data the
application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with
NULL pointer as the output buffer and 0 as the input buffer length.
The AES-SIV implementation in OpenSSL just returns success for such a call
instead of performing the associated data authentication operation.
The empty data thus will not be authenticated.</p>
<p>As this issue does not affect non-empty associated data authentication and
we expect it to be rare for an application to use empty associated data
entries this is qualified as Low severity issue.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>Alpine:3.18</code> <code>openssl</code> to version 3.1.1-r2 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230714.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/15/1">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/5">openssl-security@openssl.org</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230725-0004/">openssl-security@openssl.org</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5776808">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Inefficient Regular Expression Complexity</h2>
<div class="card__section">
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: alpine:3.18
</li>
<li class="card__meta__item">
Vulnerable module:
openssl/libcrypto3
</li>
<li class="card__meta__item">Introduced through:
docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Alpine:3.18</code>.</em>
<em>See <code>How to fix?</code> for <code>Alpine:3.18</code> relevant fixed versions and status.</em></p>
<p>Issue summary: Checking excessively long DH keys or parameters may be very slow.</p>
<p>Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.</p>
<p>The function DH_check() performs various checks on DH parameters. One of those
checks confirms that the modulus (&#39;p&#39; parameter) is not too large. Trying to use
a very large modulus is slow and OpenSSL will not normally use a modulus which
is over 10,000 bits in length.</p>
<p>However the DH_check() function checks numerous aspects of the key or parameters
that have been supplied. Some of those checks use the supplied modulus value
even if it has already been found to be too large.</p>
<p>An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulernable to a Denial of Service attack.</p>
<p>The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().</p>
<p>Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the &#39;-check&#39; option.</p>
<p>The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>Alpine:3.18</code> <code>openssl</code> to version 3.1.1-r3 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230719.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/4">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/5">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/19/6">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/31/1">openssl-security@openssl.org</a></li>
<li><a href="https://security.netapp.com/advisory/ntap-20230803-0011/">openssl-security@openssl.org</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5788370">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
<h2 class="card__title">CVE-2023-3817</h2>
<div class="card__section">
<div class="label label--low">
<span class="label__text">low severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: alpine:3.18
</li>
<li class="card__meta__item">
Vulnerable module:
openssl/libcrypto3
</li>
<li class="card__meta__item">Introduced through:
docker-image|redis@7.0.11-alpine and openssl/libcrypto3@3.1.1-r1
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
<span class="list-paths__item__arrow"></span>
openssl/libcrypto3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
.redis-rundeps@20230614.215749
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
apk-tools/apk-tools@2.14.0-r2
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
docker-image|redis@7.0.11-alpine
<span class="list-paths__item__arrow"></span>
busybox/ssl_client@1.36.1-r0
<span class="list-paths__item__arrow"></span>
openssl/libssl3@3.1.1-r1
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="nvd-description">NVD Description</h2>
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>openssl</code> package and not the <code>openssl</code> package as distributed by <code>Alpine:3.18</code>.</em>
<em>See <code>How to fix?</code> for <code>Alpine:3.18</code> relevant fixed versions and status.</em></p>
<p>Issue summary: Checking excessively long DH keys or parameters may be very slow.</p>
<p>Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.</p>
<p>The function DH_check() performs various checks on DH parameters. After fixing
CVE-2023-3446 it was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A correct q value,
if present, cannot be larger than the modulus p parameter, thus it is
unnecessary to perform these checks if q is larger than p.</p>
<p>An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulnerable to a Denial of Service attack.</p>
<p>The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().</p>
<p>Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the &#34;-check&#34; option.</p>
<p>The OpenSSL SSL/TLS implementation is not affected by this issue.</p>
<p>The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>Alpine:3.18</code> <code>openssl</code> to version 3.1.2-r0 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f">openssl-security@openssl.org</a></li>
<li><a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5">openssl-security@openssl.org</a></li>
<li><a href="https://www.openssl.org/news/secadv/20230731.txt">openssl-security@openssl.org</a></li>
<li><a href="http://www.openwall.com/lists/oss-security/2023/07/31/1">openssl-security@openssl.org</a></li>
<li><a href="http://seclists.org/fulldisclosure/2023/Jul/43">openssl-security@openssl.org</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5821142">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
</div><!-- cards -->
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:26:07 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:28:57 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:26:17 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:29:09 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:24:35 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:27:11 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following paths:</span>
@@ -476,12 +476,12 @@
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Regular Expression Denial of Service (ReDoS)</h2>
<div class="card__section">
<div class="label label--high">
<span class="label__text">high severity</span>
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
@@ -609,12 +609,10 @@
</tbody></table>
<p>By the time the string includes 14 C&#39;s, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>semver</code> to version 5.7.2, 6.3.1, 7.5.2 or higher.</p>
<p>Upgrade <code>semver</code> to version 7.5.2 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/pull/564">GitHub PR</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104">Vulnerable Code</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/internal/re.js#L138">Vulnerable Code</a></li>

View File

@@ -0,0 +1,492 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en-us">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
<link rel="shortcut icon" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.ico">
<style type="text/css">
body {
-moz-font-feature-settings: "pnum";
-webkit-font-feature-settings: "pnum";
font-variant-numeric: proportional-nums;
display: flex;
flex-direction: column;
font-feature-settings: "pnum";
font-size: 100%;
line-height: 1.5;
min-height: 100vh;
-webkit-text-size-adjust: 100%;
margin: 0;
padding: 0;
background-color: #F5F5F5;
font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
}
h1,
h2,
h3,
h4,
h5,
h6 {
font-weight: 500;
}
a,
a:link,
a:visited {
border-bottom: 1px solid #4b45a9;
text-decoration: none;
color: #4b45a9;
}
a:hover,
a:focus,
a:active {
border-bottom: 1px solid #4b45a9;
}
hr {
border: none;
margin: 1em 0;
border-top: 1px solid #c5c5c5;
}
ul {
padding: 0 1em;
margin: 1em 0;
}
code {
background-color: #EEE;
color: #333;
padding: 0.25em 0.5em;
border-radius: 0.25em;
}
pre {
background-color: #333;
font-family: monospace;
padding: 0.5em 1em 0.75em;
border-radius: 0.25em;
font-size: 14px;
}
pre code {
padding: 0;
background-color: transparent;
color: #fff;
}
a code {
border-radius: .125rem .125rem 0 0;
padding-bottom: 0;
color: #4b45a9;
}
a[href^="http://"]:after,
a[href^="https://"]:after {
background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
background-repeat: no-repeat;
background-size: .75rem;
content: "";
display: inline-block;
height: .75rem;
margin-left: .25rem;
width: .75rem;
}
/* Layout */
[class*=layout-container] {
margin: 0 auto;
max-width: 71.25em;
padding: 1.9em 1.3em;
position: relative;
}
.layout-container--short {
padding-top: 0;
padding-bottom: 0;
max-width: 48.75em;
}
.layout-container--short:after {
display: block;
content: "";
clear: both;
}
/* Header */
.header {
padding-bottom: 1px;
}
.paths {
margin-left: 8px;
}
.header-wrap {
display: flex;
flex-direction: row;
justify-content: space-between;
padding-top: 2em;
}
.project__header {
background-color: #4b45a9;
color: #fff;
margin-bottom: -1px;
padding-top: 1em;
padding-bottom: 0.25em;
border-bottom: 2px solid #BBB;
}
.project__header__title {
overflow-wrap: break-word;
word-wrap: break-word;
word-break: break-all;
margin-bottom: .1em;
margin-top: 0;
}
.timestamp {
float: right;
clear: none;
margin-bottom: 0;
}
.meta-counts {
clear: both;
display: block;
flex-wrap: wrap;
justify-content: space-between;
margin: 0 0 1.5em;
color: #fff;
clear: both;
font-size: 1.1em;
}
.meta-count {
display: block;
flex-basis: 100%;
margin: 0 1em 1em 0;
float: left;
padding-right: 1em;
border-right: 2px solid #fff;
}
.meta-count:last-child {
border-right: 0;
padding-right: 0;
margin-right: 0;
}
/* Card */
.card {
background-color: #fff;
border: 1px solid #c5c5c5;
border-radius: .25rem;
margin: 0 0 2em 0;
position: relative;
min-height: 40px;
padding: 1.5em;
}
.card .label {
background-color: #767676;
border: 2px solid #767676;
color: white;
padding: 0.25rem 0.75rem;
font-size: 0.875rem;
text-transform: uppercase;
display: inline-block;
margin: 0;
border-radius: 0.25rem;
}
.card .label__text {
vertical-align: text-top;
font-weight: bold;
}
.card .label--critical {
background-color: #AB1A1A;
border-color: #AB1A1A;
}
.card .label--high {
background-color: #CE5019;
border-color: #CE5019;
}
.card .label--medium {
background-color: #D68000;
border-color: #D68000;
}
.card .label--low {
background-color: #88879E;
border-color: #88879E;
}
.severity--low {
border-color: #88879E;
}
.severity--medium {
border-color: #D68000;
}
.severity--high {
border-color: #CE5019;
}
.severity--critical {
border-color: #AB1A1A;
}
.card--vuln {
padding-top: 4em;
}
.card--vuln .label {
left: 0;
position: absolute;
top: 1.1em;
padding-left: 1.9em;
padding-right: 1.9em;
border-radius: 0 0.25rem 0.25rem 0;
}
.card--vuln .card__section h2 {
font-size: 22px;
margin-bottom: 0.5em;
}
.card--vuln .card__section p {
margin: 0 0 0.5em 0;
}
.card--vuln .card__meta {
padding: 0 0 0 1em;
margin: 0;
font-size: 1.1em;
}
.card .card__meta__paths {
font-size: 0.9em;
}
.card--vuln .card__title {
font-size: 28px;
margin-top: 0;
}
.card--vuln .card__cta p {
margin: 0;
text-align: right;
}
.source-panel {
clear: both;
display: flex;
justify-content: flex-start;
flex-direction: column;
align-items: flex-start;
padding: 0.5em 0;
width: fit-content;
}
</style>
<style type="text/css">
.metatable {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
margin-top: 12px;
border-collapse: collapse;
border-spacing: 0;
font-variant-numeric: tabular-nums;
max-width: 51.75em;
}
tbody {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
flex-wrap: wrap;
}
.meta-row {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
outline: none;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
align-items: start;
border-top: 1px solid #d3d3d9;
padding: 8px 0 0 0;
border-bottom: none;
margin: 8px;
width: 47.75%;
}
.meta-row-label {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
color: #4c4a73;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
margin: 0;
outline: none;
text-decoration: none;
z-index: auto;
align-self: start;
flex: 1;
font-size: 1rem;
line-height: 1.5rem;
padding: 0;
text-align: left;
vertical-align: top;
text-transform: none;
letter-spacing: 0;
}
.meta-row-value {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
word-break: break-word;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: right;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
}
</style>
</head>
<body class="section-projects">
<main class="layout-stacked">
<div class="layout-stacked__header header">
<header class="project__header">
<div class="layout-container">
<a class="brand" href="https://snyk.io" title="Snyk">
<svg width="68px" height="35px" viewBox="0 0 68 35" version="1.1" xmlns="http://www.w3.org/2000/svg" role="img">
<title>Snyk - Open Source Security</title>
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g fill="#fff">
<path d="M5.732,27.278 C3.445,27.278 1.589,26.885 0,26.124 L0.483,22.472 C2.163,23.296 4.056,23.689 5.643,23.689 C6.801,23.689 7.563,23.295 7.563,22.599 C7.563,20.594 0.333,21.076 0.333,15.839 C0.333,12.491 3.407,10.729 7.259,10.729 C9.179,10.729 11.161,11.249 12.444,11.704 L11.924,15.294 C10.577,14.774 8.747,14.291 7.222,14.291 C6.282,14.291 5.518,14.621 5.518,15.231 C5.518,17.208 12.903,16.815 12.903,21.925 C12.903,25.325 9.877,27.277 5.733,27.277 L5.732,27.278 Z M25.726,26.936 L25.726,17.894 C25.726,15.827 24.811,14.85 23.069,14.85 C22.219,14.85 21.329,15.09 20.719,15.46 L20.719,26.936 L15.352,26.936 L15.352,11.262 L20.602,10.83 L20.474,13.392 L20.652,13.392 C21.784,11.87 23.702,10.716 25.992,10.716 C28.736,10.716 31.112,12.416 31.112,16.436 L31.112,26.936 L25.724,26.936 L25.726,26.936 Z M61.175,26.936 L56.879,19.479 L56.446,19.479 L56.446,26.935 L51.082,26.935 L51.082,8.37 L56.447,0 L56.447,17.323 C57.515,16.017 61.112,11.059 61.112,11.059 L67.732,11.059 L61.454,17.689 L67.949,26.95 L61.175,26.95 L61.175,26.938 L61.175,26.936 Z M44.13,11.11 L41.93,18.262 C41.5,19.606 41.08,22.079 41.08,22.079 C41.08,22.079 40.75,19.516 40.292,18.172 L37.94,11.108 L31.928,11.108 L38.462,26.935 C37.572,29.04 36.199,30.815 34.369,30.815 C34.039,30.815 33.709,30.802 33.389,30.765 L31.255,34.061 C31.928,34.441 33.212,34.835 34.737,34.835 C38.703,34.835 41.359,31.627 43.215,26.885 L49.443,11.108 L44.132,11.108 L44.13,11.11 Z"></path>
</g>
</g>
</svg>
</a>
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">June 25th 2023, 12:27:25 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
<ul>
<li class="paths">haproxy:2.6.14-alpine (apk)</li>
</ul>
</div>
<div class="meta-counts">
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
</div><!-- .layout-stacked__header -->
<section class="layout-container">
<table class="metatable">
<tbody>
<tr class="meta-row"><th class="meta-row-label">Project</th> <td class="meta-row-value">docker-image|haproxy</td></tr>
<tr class="meta-row"><th class="meta-row-label">Path</th> <td class="meta-row-value">haproxy:2.6.14-alpine</td></tr>
<tr class="meta-row"><th class="meta-row-label">Package Manager</th> <td class="meta-row-value">apk</td></tr>
</tbody>
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>
</html>

View File

@@ -7,7 +7,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="1 known vulnerabilities found in 1 vulnerable dependency paths.">
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
@@ -456,109 +456,35 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:17:00 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:27:55 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following paths:</span>
<span>Scanned the following path:</span>
<ul>
<li class="paths">/argo-cd/argoproj/argo-cd/v2 (gomodules)</li><li class="paths">/argo-cd (yarn)</li>
<li class="paths">redis:7.0.11-alpine (apk)</li>
</ul>
</div>
<div class="meta-counts">
<div class="meta-count"><span>1</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>1 vulnerable dependency paths</span></div>
<div class="meta-count"><span>1851</span> <span>dependencies</span></div>
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
</div><!-- .layout-stacked__header -->
<section class="layout-container">
<table class="metatable">
<tbody>
<tr class="meta-row"><th class="meta-row-label">Project</th> <td class="meta-row-value">docker-image|redis</td></tr>
<tr class="meta-row"><th class="meta-row-label">Path</th> <td class="meta-row-value">redis:7.0.11-alpine</td></tr>
<tr class="meta-row"><th class="meta-row-label">Package Manager</th> <td class="meta-row-value">apk</td></tr>
</tbody>
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
<h2 class="card__title">Denial of Service (DoS)</h2>
<div class="card__section">
<div class="label label--high">
<span class="label__text">high severity</span>
</div>
<hr/>
<ul class="card__meta">
<li class="card__meta__item">
Package Manager: golang
</li>
<li class="card__meta__item">
Vulnerable module:
nhooyr.io/websocket
</li>
<li class="card__meta__item">Introduced through:
github.com/argoproj/argo-cd/v2@0.0.0, github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0 and others
</li>
</ul>
<hr/>
<h3 class="card__section__title">Detailed paths</h3>
<ul class="card__meta__paths">
<li>
<span class="list-paths__item__introduced"><em>Introduced through</em>:
github.com/argoproj/argo-cd/v2@0.0.0
<span class="list-paths__item__arrow"></span>
github.com/improbable-eng/grpc-web/go/grpcweb@0.15.0
<span class="list-paths__item__arrow"></span>
nhooyr.io/websocket@1.8.6
</span>
</li>
</ul><!-- .list-paths -->
</div><!-- .card__section -->
<hr/>
<!-- Overview -->
<h2 id="overview">Overview</h2>
<p><a href="https://github.com/nhooyr/websocket">nhooyr.io/websocket</a> is a minimal and idiomatic WebSocket library for Go.</p>
<p>Affected versions of this package are vulnerable to Denial of Service (DoS). A double channel close panic is possible if a peer sent back multiple pongs for every ping.
If the second pong arrived before the ping <code>goroutine</code> deleted its channel from the map, the channel would be closed twice and a panic would
occur.</p>
<h2 id="details">Details</h2>
<p>Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.</p>
<p>Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.</p>
<p>One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.</p>
<p>When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.</p>
<p>Two common types of DoS vulnerabilities:</p>
<ul>
<li><p>High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, <a href="SNYK-JAVA-COMMONSFILEUPLOAD-30082">commons-fileupload:commons-fileupload</a>.</p>
</li>
<li><p>Crash - An attacker sending crafted requests that could cause the system to crash. For Example, <a href="https://snyk.io/vuln/npm:ws:20171108">npm <code>ws</code> package</a></p>
</li>
</ul>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>nhooyr.io/websocket</code> to version 1.8.7 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/nhooyr/websocket/commit/3604edcb857415cb2c1213d63328cdcd738f2328">GitHub Commit</a></li>
<li><a href="https://github.com/nhooyr/websocket/pull/291">GitHub PR</a></li>
</ul>
<hr/>
<div class="cta card__cta">
<p><a href="https://snyk.io/vuln/SNYK-GOLANG-NHOOYRIOWEBSOCKET-1244972">More about this vulnerability</a></p>
</div>
</div><!-- .card -->
</div><!-- cards -->
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:24:07 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:26:38 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:24:18 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:26:50 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:22:11 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:24:05 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following paths:</span>
@@ -468,7 +468,7 @@
<div class="meta-counts">
<div class="meta-count"><span>1</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>1 vulnerable dependency paths</span></div>
<div class="meta-count"><span>1727</span> <span>dependencies</span></div>
<div class="meta-count"><span>1728</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
@@ -476,12 +476,12 @@
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Regular Expression Denial of Service (ReDoS)</h2>
<div class="card__section">
<div class="label label--high">
<span class="label__text">high severity</span>
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
@@ -609,12 +609,10 @@
</tbody></table>
<p>By the time the string includes 14 C&#39;s, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>semver</code> to version 5.7.2, 6.3.1, 7.5.2 or higher.</p>
<p>Upgrade <code>semver</code> to version 7.5.2 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/pull/564">GitHub PR</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104">Vulnerable Code</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/internal/re.js#L138">Vulnerable Code</a></li>

View File

@@ -0,0 +1,492 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en-us">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
<link rel="shortcut icon" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.ico">
<style type="text/css">
body {
-moz-font-feature-settings: "pnum";
-webkit-font-feature-settings: "pnum";
font-variant-numeric: proportional-nums;
display: flex;
flex-direction: column;
font-feature-settings: "pnum";
font-size: 100%;
line-height: 1.5;
min-height: 100vh;
-webkit-text-size-adjust: 100%;
margin: 0;
padding: 0;
background-color: #F5F5F5;
font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
}
h1,
h2,
h3,
h4,
h5,
h6 {
font-weight: 500;
}
a,
a:link,
a:visited {
border-bottom: 1px solid #4b45a9;
text-decoration: none;
color: #4b45a9;
}
a:hover,
a:focus,
a:active {
border-bottom: 1px solid #4b45a9;
}
hr {
border: none;
margin: 1em 0;
border-top: 1px solid #c5c5c5;
}
ul {
padding: 0 1em;
margin: 1em 0;
}
code {
background-color: #EEE;
color: #333;
padding: 0.25em 0.5em;
border-radius: 0.25em;
}
pre {
background-color: #333;
font-family: monospace;
padding: 0.5em 1em 0.75em;
border-radius: 0.25em;
font-size: 14px;
}
pre code {
padding: 0;
background-color: transparent;
color: #fff;
}
a code {
border-radius: .125rem .125rem 0 0;
padding-bottom: 0;
color: #4b45a9;
}
a[href^="http://"]:after,
a[href^="https://"]:after {
background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
background-repeat: no-repeat;
background-size: .75rem;
content: "";
display: inline-block;
height: .75rem;
margin-left: .25rem;
width: .75rem;
}
/* Layout */
[class*=layout-container] {
margin: 0 auto;
max-width: 71.25em;
padding: 1.9em 1.3em;
position: relative;
}
.layout-container--short {
padding-top: 0;
padding-bottom: 0;
max-width: 48.75em;
}
.layout-container--short:after {
display: block;
content: "";
clear: both;
}
/* Header */
.header {
padding-bottom: 1px;
}
.paths {
margin-left: 8px;
}
.header-wrap {
display: flex;
flex-direction: row;
justify-content: space-between;
padding-top: 2em;
}
.project__header {
background-color: #4b45a9;
color: #fff;
margin-bottom: -1px;
padding-top: 1em;
padding-bottom: 0.25em;
border-bottom: 2px solid #BBB;
}
.project__header__title {
overflow-wrap: break-word;
word-wrap: break-word;
word-break: break-all;
margin-bottom: .1em;
margin-top: 0;
}
.timestamp {
float: right;
clear: none;
margin-bottom: 0;
}
.meta-counts {
clear: both;
display: block;
flex-wrap: wrap;
justify-content: space-between;
margin: 0 0 1.5em;
color: #fff;
clear: both;
font-size: 1.1em;
}
.meta-count {
display: block;
flex-basis: 100%;
margin: 0 1em 1em 0;
float: left;
padding-right: 1em;
border-right: 2px solid #fff;
}
.meta-count:last-child {
border-right: 0;
padding-right: 0;
margin-right: 0;
}
/* Card */
.card {
background-color: #fff;
border: 1px solid #c5c5c5;
border-radius: .25rem;
margin: 0 0 2em 0;
position: relative;
min-height: 40px;
padding: 1.5em;
}
.card .label {
background-color: #767676;
border: 2px solid #767676;
color: white;
padding: 0.25rem 0.75rem;
font-size: 0.875rem;
text-transform: uppercase;
display: inline-block;
margin: 0;
border-radius: 0.25rem;
}
.card .label__text {
vertical-align: text-top;
font-weight: bold;
}
.card .label--critical {
background-color: #AB1A1A;
border-color: #AB1A1A;
}
.card .label--high {
background-color: #CE5019;
border-color: #CE5019;
}
.card .label--medium {
background-color: #D68000;
border-color: #D68000;
}
.card .label--low {
background-color: #88879E;
border-color: #88879E;
}
.severity--low {
border-color: #88879E;
}
.severity--medium {
border-color: #D68000;
}
.severity--high {
border-color: #CE5019;
}
.severity--critical {
border-color: #AB1A1A;
}
.card--vuln {
padding-top: 4em;
}
.card--vuln .label {
left: 0;
position: absolute;
top: 1.1em;
padding-left: 1.9em;
padding-right: 1.9em;
border-radius: 0 0.25rem 0.25rem 0;
}
.card--vuln .card__section h2 {
font-size: 22px;
margin-bottom: 0.5em;
}
.card--vuln .card__section p {
margin: 0 0 0.5em 0;
}
.card--vuln .card__meta {
padding: 0 0 0 1em;
margin: 0;
font-size: 1.1em;
}
.card .card__meta__paths {
font-size: 0.9em;
}
.card--vuln .card__title {
font-size: 28px;
margin-top: 0;
}
.card--vuln .card__cta p {
margin: 0;
text-align: right;
}
.source-panel {
clear: both;
display: flex;
justify-content: flex-start;
flex-direction: column;
align-items: flex-start;
padding: 0.5em 0;
width: fit-content;
}
</style>
<style type="text/css">
.metatable {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
margin-top: 12px;
border-collapse: collapse;
border-spacing: 0;
font-variant-numeric: tabular-nums;
max-width: 51.75em;
}
tbody {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
flex-wrap: wrap;
}
.meta-row {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
outline: none;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
align-items: start;
border-top: 1px solid #d3d3d9;
padding: 8px 0 0 0;
border-bottom: none;
margin: 8px;
width: 47.75%;
}
.meta-row-label {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
color: #4c4a73;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
margin: 0;
outline: none;
text-decoration: none;
z-index: auto;
align-self: start;
flex: 1;
font-size: 1rem;
line-height: 1.5rem;
padding: 0;
text-align: left;
vertical-align: top;
text-transform: none;
letter-spacing: 0;
}
.meta-row-value {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
word-break: break-word;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: right;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
}
</style>
</head>
<body class="section-projects">
<main class="layout-stacked">
<div class="layout-stacked__header header">
<header class="project__header">
<div class="layout-container">
<a class="brand" href="https://snyk.io" title="Snyk">
<svg width="68px" height="35px" viewBox="0 0 68 35" version="1.1" xmlns="http://www.w3.org/2000/svg" role="img">
<title>Snyk - Open Source Security</title>
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g fill="#fff">
<path d="M5.732,27.278 C3.445,27.278 1.589,26.885 0,26.124 L0.483,22.472 C2.163,23.296 4.056,23.689 5.643,23.689 C6.801,23.689 7.563,23.295 7.563,22.599 C7.563,20.594 0.333,21.076 0.333,15.839 C0.333,12.491 3.407,10.729 7.259,10.729 C9.179,10.729 11.161,11.249 12.444,11.704 L11.924,15.294 C10.577,14.774 8.747,14.291 7.222,14.291 C6.282,14.291 5.518,14.621 5.518,15.231 C5.518,17.208 12.903,16.815 12.903,21.925 C12.903,25.325 9.877,27.277 5.733,27.277 L5.732,27.278 Z M25.726,26.936 L25.726,17.894 C25.726,15.827 24.811,14.85 23.069,14.85 C22.219,14.85 21.329,15.09 20.719,15.46 L20.719,26.936 L15.352,26.936 L15.352,11.262 L20.602,10.83 L20.474,13.392 L20.652,13.392 C21.784,11.87 23.702,10.716 25.992,10.716 C28.736,10.716 31.112,12.416 31.112,16.436 L31.112,26.936 L25.724,26.936 L25.726,26.936 Z M61.175,26.936 L56.879,19.479 L56.446,19.479 L56.446,26.935 L51.082,26.935 L51.082,8.37 L56.447,0 L56.447,17.323 C57.515,16.017 61.112,11.059 61.112,11.059 L67.732,11.059 L61.454,17.689 L67.949,26.95 L61.175,26.95 L61.175,26.938 L61.175,26.936 Z M44.13,11.11 L41.93,18.262 C41.5,19.606 41.08,22.079 41.08,22.079 C41.08,22.079 40.75,19.516 40.292,18.172 L37.94,11.108 L31.928,11.108 L38.462,26.935 C37.572,29.04 36.199,30.815 34.369,30.815 C34.039,30.815 33.709,30.802 33.389,30.765 L31.255,34.061 C31.928,34.441 33.212,34.835 34.737,34.835 C38.703,34.835 41.359,31.627 43.215,26.885 L49.443,11.108 L44.132,11.108 L44.13,11.11 Z"></path>
</g>
</g>
</svg>
</a>
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">June 25th 2023, 12:24:19 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
<ul>
<li class="paths">haproxy:2.6.14-alpine (apk)</li>
</ul>
</div>
<div class="meta-counts">
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
</div><!-- .layout-stacked__header -->
<section class="layout-container">
<table class="metatable">
<tbody>
<tr class="meta-row"><th class="meta-row-label">Project</th> <td class="meta-row-value">docker-image|haproxy</td></tr>
<tr class="meta-row"><th class="meta-row-label">Path</th> <td class="meta-row-value">haproxy:2.6.14-alpine</td></tr>
<tr class="meta-row"><th class="meta-row-label">Package Manager</th> <td class="meta-row-value">apk</td></tr>
</tbody>
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>
</html>

View File

@@ -0,0 +1,492 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en-us">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
<link rel="shortcut icon" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.ico">
<style type="text/css">
body {
-moz-font-feature-settings: "pnum";
-webkit-font-feature-settings: "pnum";
font-variant-numeric: proportional-nums;
display: flex;
flex-direction: column;
font-feature-settings: "pnum";
font-size: 100%;
line-height: 1.5;
min-height: 100vh;
-webkit-text-size-adjust: 100%;
margin: 0;
padding: 0;
background-color: #F5F5F5;
font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
}
h1,
h2,
h3,
h4,
h5,
h6 {
font-weight: 500;
}
a,
a:link,
a:visited {
border-bottom: 1px solid #4b45a9;
text-decoration: none;
color: #4b45a9;
}
a:hover,
a:focus,
a:active {
border-bottom: 1px solid #4b45a9;
}
hr {
border: none;
margin: 1em 0;
border-top: 1px solid #c5c5c5;
}
ul {
padding: 0 1em;
margin: 1em 0;
}
code {
background-color: #EEE;
color: #333;
padding: 0.25em 0.5em;
border-radius: 0.25em;
}
pre {
background-color: #333;
font-family: monospace;
padding: 0.5em 1em 0.75em;
border-radius: 0.25em;
font-size: 14px;
}
pre code {
padding: 0;
background-color: transparent;
color: #fff;
}
a code {
border-radius: .125rem .125rem 0 0;
padding-bottom: 0;
color: #4b45a9;
}
a[href^="http://"]:after,
a[href^="https://"]:after {
background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
background-repeat: no-repeat;
background-size: .75rem;
content: "";
display: inline-block;
height: .75rem;
margin-left: .25rem;
width: .75rem;
}
/* Layout */
[class*=layout-container] {
margin: 0 auto;
max-width: 71.25em;
padding: 1.9em 1.3em;
position: relative;
}
.layout-container--short {
padding-top: 0;
padding-bottom: 0;
max-width: 48.75em;
}
.layout-container--short:after {
display: block;
content: "";
clear: both;
}
/* Header */
.header {
padding-bottom: 1px;
}
.paths {
margin-left: 8px;
}
.header-wrap {
display: flex;
flex-direction: row;
justify-content: space-between;
padding-top: 2em;
}
.project__header {
background-color: #4b45a9;
color: #fff;
margin-bottom: -1px;
padding-top: 1em;
padding-bottom: 0.25em;
border-bottom: 2px solid #BBB;
}
.project__header__title {
overflow-wrap: break-word;
word-wrap: break-word;
word-break: break-all;
margin-bottom: .1em;
margin-top: 0;
}
.timestamp {
float: right;
clear: none;
margin-bottom: 0;
}
.meta-counts {
clear: both;
display: block;
flex-wrap: wrap;
justify-content: space-between;
margin: 0 0 1.5em;
color: #fff;
clear: both;
font-size: 1.1em;
}
.meta-count {
display: block;
flex-basis: 100%;
margin: 0 1em 1em 0;
float: left;
padding-right: 1em;
border-right: 2px solid #fff;
}
.meta-count:last-child {
border-right: 0;
padding-right: 0;
margin-right: 0;
}
/* Card */
.card {
background-color: #fff;
border: 1px solid #c5c5c5;
border-radius: .25rem;
margin: 0 0 2em 0;
position: relative;
min-height: 40px;
padding: 1.5em;
}
.card .label {
background-color: #767676;
border: 2px solid #767676;
color: white;
padding: 0.25rem 0.75rem;
font-size: 0.875rem;
text-transform: uppercase;
display: inline-block;
margin: 0;
border-radius: 0.25rem;
}
.card .label__text {
vertical-align: text-top;
font-weight: bold;
}
.card .label--critical {
background-color: #AB1A1A;
border-color: #AB1A1A;
}
.card .label--high {
background-color: #CE5019;
border-color: #CE5019;
}
.card .label--medium {
background-color: #D68000;
border-color: #D68000;
}
.card .label--low {
background-color: #88879E;
border-color: #88879E;
}
.severity--low {
border-color: #88879E;
}
.severity--medium {
border-color: #D68000;
}
.severity--high {
border-color: #CE5019;
}
.severity--critical {
border-color: #AB1A1A;
}
.card--vuln {
padding-top: 4em;
}
.card--vuln .label {
left: 0;
position: absolute;
top: 1.1em;
padding-left: 1.9em;
padding-right: 1.9em;
border-radius: 0 0.25rem 0.25rem 0;
}
.card--vuln .card__section h2 {
font-size: 22px;
margin-bottom: 0.5em;
}
.card--vuln .card__section p {
margin: 0 0 0.5em 0;
}
.card--vuln .card__meta {
padding: 0 0 0 1em;
margin: 0;
font-size: 1.1em;
}
.card .card__meta__paths {
font-size: 0.9em;
}
.card--vuln .card__title {
font-size: 28px;
margin-top: 0;
}
.card--vuln .card__cta p {
margin: 0;
text-align: right;
}
.source-panel {
clear: both;
display: flex;
justify-content: flex-start;
flex-direction: column;
align-items: flex-start;
padding: 0.5em 0;
width: fit-content;
}
</style>
<style type="text/css">
.metatable {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
margin-top: 12px;
border-collapse: collapse;
border-spacing: 0;
font-variant-numeric: tabular-nums;
max-width: 51.75em;
}
tbody {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
flex-wrap: wrap;
}
.meta-row {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
outline: none;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
align-items: start;
border-top: 1px solid #d3d3d9;
padding: 8px 0 0 0;
border-bottom: none;
margin: 8px;
width: 47.75%;
}
.meta-row-label {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
color: #4c4a73;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
margin: 0;
outline: none;
text-decoration: none;
z-index: auto;
align-self: start;
flex: 1;
font-size: 1rem;
line-height: 1.5rem;
padding: 0;
text-align: left;
vertical-align: top;
text-transform: none;
letter-spacing: 0;
}
.meta-row-value {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
word-break: break-word;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: right;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
}
</style>
</head>
<body class="section-projects">
<main class="layout-stacked">
<div class="layout-stacked__header header">
<header class="project__header">
<div class="layout-container">
<a class="brand" href="https://snyk.io" title="Snyk">
<svg width="68px" height="35px" viewBox="0 0 68 35" version="1.1" xmlns="http://www.w3.org/2000/svg" role="img">
<title>Snyk - Open Source Security</title>
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g fill="#fff">
<path d="M5.732,27.278 C3.445,27.278 1.589,26.885 0,26.124 L0.483,22.472 C2.163,23.296 4.056,23.689 5.643,23.689 C6.801,23.689 7.563,23.295 7.563,22.599 C7.563,20.594 0.333,21.076 0.333,15.839 C0.333,12.491 3.407,10.729 7.259,10.729 C9.179,10.729 11.161,11.249 12.444,11.704 L11.924,15.294 C10.577,14.774 8.747,14.291 7.222,14.291 C6.282,14.291 5.518,14.621 5.518,15.231 C5.518,17.208 12.903,16.815 12.903,21.925 C12.903,25.325 9.877,27.277 5.733,27.277 L5.732,27.278 Z M25.726,26.936 L25.726,17.894 C25.726,15.827 24.811,14.85 23.069,14.85 C22.219,14.85 21.329,15.09 20.719,15.46 L20.719,26.936 L15.352,26.936 L15.352,11.262 L20.602,10.83 L20.474,13.392 L20.652,13.392 C21.784,11.87 23.702,10.716 25.992,10.716 C28.736,10.716 31.112,12.416 31.112,16.436 L31.112,26.936 L25.724,26.936 L25.726,26.936 Z M61.175,26.936 L56.879,19.479 L56.446,19.479 L56.446,26.935 L51.082,26.935 L51.082,8.37 L56.447,0 L56.447,17.323 C57.515,16.017 61.112,11.059 61.112,11.059 L67.732,11.059 L61.454,17.689 L67.949,26.95 L61.175,26.95 L61.175,26.938 L61.175,26.936 Z M44.13,11.11 L41.93,18.262 C41.5,19.606 41.08,22.079 41.08,22.079 C41.08,22.079 40.75,19.516 40.292,18.172 L37.94,11.108 L31.928,11.108 L38.462,26.935 C37.572,29.04 36.199,30.815 34.369,30.815 C34.039,30.815 33.709,30.802 33.389,30.765 L31.255,34.061 C31.928,34.441 33.212,34.835 34.737,34.835 C38.703,34.835 41.359,31.627 43.215,26.885 L49.443,11.108 L44.132,11.108 L44.13,11.11 Z"></path>
</g>
</g>
</svg>
</a>
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">June 25th 2023, 12:24:58 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
<ul>
<li class="paths">redis:7.0.11-alpine (apk)</li>
</ul>
</div>
<div class="meta-counts">
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
</div><!-- .layout-stacked__header -->
<section class="layout-container">
<table class="metatable">
<tbody>
<tr class="meta-row"><th class="meta-row-label">Project</th> <td class="meta-row-value">docker-image|redis</td></tr>
<tr class="meta-row"><th class="meta-row-label">Path</th> <td class="meta-row-value">redis:7.0.11-alpine</td></tr>
<tr class="meta-row"><th class="meta-row-label">Package Manager</th> <td class="meta-row-value">apk</td></tr>
</tbody>
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>
</html>

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:21:45 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:23:36 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:21:57 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:23:49 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>

View File

@@ -456,7 +456,7 @@
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">August 6th 2023, 12:19:44 am (UTC+00:00)</p>
<p class="timestamp">June 25th 2023, 12:21:08 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following paths:</span>
@@ -468,7 +468,7 @@
<div class="meta-counts">
<div class="meta-count"><span>1</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>1 vulnerable dependency paths</span></div>
<div class="meta-count"><span>1748</span> <span>dependencies</span></div>
<div class="meta-count"><span>1749</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
@@ -476,12 +476,12 @@
<div class="layout-container" style="padding-top: 35px;">
<div class="cards--vuln filter--patch filter--ignore">
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
<h2 class="card__title">Regular Expression Denial of Service (ReDoS)</h2>
<div class="card__section">
<div class="label label--high">
<span class="label__text">high severity</span>
<div class="label label--medium">
<span class="label__text">medium severity</span>
</div>
<hr/>
@@ -609,12 +609,10 @@
</tbody></table>
<p>By the time the string includes 14 C&#39;s, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.</p>
<h2 id="remediation">Remediation</h2>
<p>Upgrade <code>semver</code> to version 5.7.2, 6.3.1, 7.5.2 or higher.</p>
<p>Upgrade <code>semver</code> to version 7.5.2 or higher.</p>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c">GitHub Commit</a></li>
<li><a href="https://github.com/npm/node-semver/pull/564">GitHub PR</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104">Vulnerable Code</a></li>
<li><a href="https://github.com/npm/node-semver/blob/main/internal/re.js#L138">Vulnerable Code</a></li>

View File

@@ -0,0 +1,492 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en-us">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
<link rel="shortcut icon" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.ico">
<style type="text/css">
body {
-moz-font-feature-settings: "pnum";
-webkit-font-feature-settings: "pnum";
font-variant-numeric: proportional-nums;
display: flex;
flex-direction: column;
font-feature-settings: "pnum";
font-size: 100%;
line-height: 1.5;
min-height: 100vh;
-webkit-text-size-adjust: 100%;
margin: 0;
padding: 0;
background-color: #F5F5F5;
font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
}
h1,
h2,
h3,
h4,
h5,
h6 {
font-weight: 500;
}
a,
a:link,
a:visited {
border-bottom: 1px solid #4b45a9;
text-decoration: none;
color: #4b45a9;
}
a:hover,
a:focus,
a:active {
border-bottom: 1px solid #4b45a9;
}
hr {
border: none;
margin: 1em 0;
border-top: 1px solid #c5c5c5;
}
ul {
padding: 0 1em;
margin: 1em 0;
}
code {
background-color: #EEE;
color: #333;
padding: 0.25em 0.5em;
border-radius: 0.25em;
}
pre {
background-color: #333;
font-family: monospace;
padding: 0.5em 1em 0.75em;
border-radius: 0.25em;
font-size: 14px;
}
pre code {
padding: 0;
background-color: transparent;
color: #fff;
}
a code {
border-radius: .125rem .125rem 0 0;
padding-bottom: 0;
color: #4b45a9;
}
a[href^="http://"]:after,
a[href^="https://"]:after {
background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
background-repeat: no-repeat;
background-size: .75rem;
content: "";
display: inline-block;
height: .75rem;
margin-left: .25rem;
width: .75rem;
}
/* Layout */
[class*=layout-container] {
margin: 0 auto;
max-width: 71.25em;
padding: 1.9em 1.3em;
position: relative;
}
.layout-container--short {
padding-top: 0;
padding-bottom: 0;
max-width: 48.75em;
}
.layout-container--short:after {
display: block;
content: "";
clear: both;
}
/* Header */
.header {
padding-bottom: 1px;
}
.paths {
margin-left: 8px;
}
.header-wrap {
display: flex;
flex-direction: row;
justify-content: space-between;
padding-top: 2em;
}
.project__header {
background-color: #4b45a9;
color: #fff;
margin-bottom: -1px;
padding-top: 1em;
padding-bottom: 0.25em;
border-bottom: 2px solid #BBB;
}
.project__header__title {
overflow-wrap: break-word;
word-wrap: break-word;
word-break: break-all;
margin-bottom: .1em;
margin-top: 0;
}
.timestamp {
float: right;
clear: none;
margin-bottom: 0;
}
.meta-counts {
clear: both;
display: block;
flex-wrap: wrap;
justify-content: space-between;
margin: 0 0 1.5em;
color: #fff;
clear: both;
font-size: 1.1em;
}
.meta-count {
display: block;
flex-basis: 100%;
margin: 0 1em 1em 0;
float: left;
padding-right: 1em;
border-right: 2px solid #fff;
}
.meta-count:last-child {
border-right: 0;
padding-right: 0;
margin-right: 0;
}
/* Card */
.card {
background-color: #fff;
border: 1px solid #c5c5c5;
border-radius: .25rem;
margin: 0 0 2em 0;
position: relative;
min-height: 40px;
padding: 1.5em;
}
.card .label {
background-color: #767676;
border: 2px solid #767676;
color: white;
padding: 0.25rem 0.75rem;
font-size: 0.875rem;
text-transform: uppercase;
display: inline-block;
margin: 0;
border-radius: 0.25rem;
}
.card .label__text {
vertical-align: text-top;
font-weight: bold;
}
.card .label--critical {
background-color: #AB1A1A;
border-color: #AB1A1A;
}
.card .label--high {
background-color: #CE5019;
border-color: #CE5019;
}
.card .label--medium {
background-color: #D68000;
border-color: #D68000;
}
.card .label--low {
background-color: #88879E;
border-color: #88879E;
}
.severity--low {
border-color: #88879E;
}
.severity--medium {
border-color: #D68000;
}
.severity--high {
border-color: #CE5019;
}
.severity--critical {
border-color: #AB1A1A;
}
.card--vuln {
padding-top: 4em;
}
.card--vuln .label {
left: 0;
position: absolute;
top: 1.1em;
padding-left: 1.9em;
padding-right: 1.9em;
border-radius: 0 0.25rem 0.25rem 0;
}
.card--vuln .card__section h2 {
font-size: 22px;
margin-bottom: 0.5em;
}
.card--vuln .card__section p {
margin: 0 0 0.5em 0;
}
.card--vuln .card__meta {
padding: 0 0 0 1em;
margin: 0;
font-size: 1.1em;
}
.card .card__meta__paths {
font-size: 0.9em;
}
.card--vuln .card__title {
font-size: 28px;
margin-top: 0;
}
.card--vuln .card__cta p {
margin: 0;
text-align: right;
}
.source-panel {
clear: both;
display: flex;
justify-content: flex-start;
flex-direction: column;
align-items: flex-start;
padding: 0.5em 0;
width: fit-content;
}
</style>
<style type="text/css">
.metatable {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
margin-top: 12px;
border-collapse: collapse;
border-spacing: 0;
font-variant-numeric: tabular-nums;
max-width: 51.75em;
}
tbody {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
flex-wrap: wrap;
}
.meta-row {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
outline: none;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
align-items: start;
border-top: 1px solid #d3d3d9;
padding: 8px 0 0 0;
border-bottom: none;
margin: 8px;
width: 47.75%;
}
.meta-row-label {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
color: #4c4a73;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
margin: 0;
outline: none;
text-decoration: none;
z-index: auto;
align-self: start;
flex: 1;
font-size: 1rem;
line-height: 1.5rem;
padding: 0;
text-align: left;
vertical-align: top;
text-transform: none;
letter-spacing: 0;
}
.meta-row-value {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
word-break: break-word;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: right;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
}
</style>
</head>
<body class="section-projects">
<main class="layout-stacked">
<div class="layout-stacked__header header">
<header class="project__header">
<div class="layout-container">
<a class="brand" href="https://snyk.io" title="Snyk">
<svg width="68px" height="35px" viewBox="0 0 68 35" version="1.1" xmlns="http://www.w3.org/2000/svg" role="img">
<title>Snyk - Open Source Security</title>
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g fill="#fff">
<path d="M5.732,27.278 C3.445,27.278 1.589,26.885 0,26.124 L0.483,22.472 C2.163,23.296 4.056,23.689 5.643,23.689 C6.801,23.689 7.563,23.295 7.563,22.599 C7.563,20.594 0.333,21.076 0.333,15.839 C0.333,12.491 3.407,10.729 7.259,10.729 C9.179,10.729 11.161,11.249 12.444,11.704 L11.924,15.294 C10.577,14.774 8.747,14.291 7.222,14.291 C6.282,14.291 5.518,14.621 5.518,15.231 C5.518,17.208 12.903,16.815 12.903,21.925 C12.903,25.325 9.877,27.277 5.733,27.277 L5.732,27.278 Z M25.726,26.936 L25.726,17.894 C25.726,15.827 24.811,14.85 23.069,14.85 C22.219,14.85 21.329,15.09 20.719,15.46 L20.719,26.936 L15.352,26.936 L15.352,11.262 L20.602,10.83 L20.474,13.392 L20.652,13.392 C21.784,11.87 23.702,10.716 25.992,10.716 C28.736,10.716 31.112,12.416 31.112,16.436 L31.112,26.936 L25.724,26.936 L25.726,26.936 Z M61.175,26.936 L56.879,19.479 L56.446,19.479 L56.446,26.935 L51.082,26.935 L51.082,8.37 L56.447,0 L56.447,17.323 C57.515,16.017 61.112,11.059 61.112,11.059 L67.732,11.059 L61.454,17.689 L67.949,26.95 L61.175,26.95 L61.175,26.938 L61.175,26.936 Z M44.13,11.11 L41.93,18.262 C41.5,19.606 41.08,22.079 41.08,22.079 C41.08,22.079 40.75,19.516 40.292,18.172 L37.94,11.108 L31.928,11.108 L38.462,26.935 C37.572,29.04 36.199,30.815 34.369,30.815 C34.039,30.815 33.709,30.802 33.389,30.765 L31.255,34.061 C31.928,34.441 33.212,34.835 34.737,34.835 C38.703,34.835 41.359,31.627 43.215,26.885 L49.443,11.108 L44.132,11.108 L44.13,11.11 Z"></path>
</g>
</g>
</svg>
</a>
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">June 25th 2023, 12:21:23 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
<ul>
<li class="paths">haproxy:2.6.14-alpine (apk)</li>
</ul>
</div>
<div class="meta-counts">
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
</div><!-- .layout-stacked__header -->
<section class="layout-container">
<table class="metatable">
<tbody>
<tr class="meta-row"><th class="meta-row-label">Project</th> <td class="meta-row-value">docker-image|haproxy</td></tr>
<tr class="meta-row"><th class="meta-row-label">Path</th> <td class="meta-row-value">haproxy:2.6.14-alpine</td></tr>
<tr class="meta-row"><th class="meta-row-label">Package Manager</th> <td class="meta-row-value">apk</td></tr>
</tbody>
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>
</html>

View File

@@ -0,0 +1,492 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
<meta http-equiv="Content-Language" content="en-us">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>Snyk test report</title>
<meta name="description" content="0 known vulnerabilities found in 0 vulnerable dependency paths.">
<base target="_blank">
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
sizes="194x194">
<link rel="shortcut icon" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.ico">
<style type="text/css">
body {
-moz-font-feature-settings: "pnum";
-webkit-font-feature-settings: "pnum";
font-variant-numeric: proportional-nums;
display: flex;
flex-direction: column;
font-feature-settings: "pnum";
font-size: 100%;
line-height: 1.5;
min-height: 100vh;
-webkit-text-size-adjust: 100%;
margin: 0;
padding: 0;
background-color: #F5F5F5;
font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
}
h1,
h2,
h3,
h4,
h5,
h6 {
font-weight: 500;
}
a,
a:link,
a:visited {
border-bottom: 1px solid #4b45a9;
text-decoration: none;
color: #4b45a9;
}
a:hover,
a:focus,
a:active {
border-bottom: 1px solid #4b45a9;
}
hr {
border: none;
margin: 1em 0;
border-top: 1px solid #c5c5c5;
}
ul {
padding: 0 1em;
margin: 1em 0;
}
code {
background-color: #EEE;
color: #333;
padding: 0.25em 0.5em;
border-radius: 0.25em;
}
pre {
background-color: #333;
font-family: monospace;
padding: 0.5em 1em 0.75em;
border-radius: 0.25em;
font-size: 14px;
}
pre code {
padding: 0;
background-color: transparent;
color: #fff;
}
a code {
border-radius: .125rem .125rem 0 0;
padding-bottom: 0;
color: #4b45a9;
}
a[href^="http://"]:after,
a[href^="https://"]:after {
background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
background-repeat: no-repeat;
background-size: .75rem;
content: "";
display: inline-block;
height: .75rem;
margin-left: .25rem;
width: .75rem;
}
/* Layout */
[class*=layout-container] {
margin: 0 auto;
max-width: 71.25em;
padding: 1.9em 1.3em;
position: relative;
}
.layout-container--short {
padding-top: 0;
padding-bottom: 0;
max-width: 48.75em;
}
.layout-container--short:after {
display: block;
content: "";
clear: both;
}
/* Header */
.header {
padding-bottom: 1px;
}
.paths {
margin-left: 8px;
}
.header-wrap {
display: flex;
flex-direction: row;
justify-content: space-between;
padding-top: 2em;
}
.project__header {
background-color: #4b45a9;
color: #fff;
margin-bottom: -1px;
padding-top: 1em;
padding-bottom: 0.25em;
border-bottom: 2px solid #BBB;
}
.project__header__title {
overflow-wrap: break-word;
word-wrap: break-word;
word-break: break-all;
margin-bottom: .1em;
margin-top: 0;
}
.timestamp {
float: right;
clear: none;
margin-bottom: 0;
}
.meta-counts {
clear: both;
display: block;
flex-wrap: wrap;
justify-content: space-between;
margin: 0 0 1.5em;
color: #fff;
clear: both;
font-size: 1.1em;
}
.meta-count {
display: block;
flex-basis: 100%;
margin: 0 1em 1em 0;
float: left;
padding-right: 1em;
border-right: 2px solid #fff;
}
.meta-count:last-child {
border-right: 0;
padding-right: 0;
margin-right: 0;
}
/* Card */
.card {
background-color: #fff;
border: 1px solid #c5c5c5;
border-radius: .25rem;
margin: 0 0 2em 0;
position: relative;
min-height: 40px;
padding: 1.5em;
}
.card .label {
background-color: #767676;
border: 2px solid #767676;
color: white;
padding: 0.25rem 0.75rem;
font-size: 0.875rem;
text-transform: uppercase;
display: inline-block;
margin: 0;
border-radius: 0.25rem;
}
.card .label__text {
vertical-align: text-top;
font-weight: bold;
}
.card .label--critical {
background-color: #AB1A1A;
border-color: #AB1A1A;
}
.card .label--high {
background-color: #CE5019;
border-color: #CE5019;
}
.card .label--medium {
background-color: #D68000;
border-color: #D68000;
}
.card .label--low {
background-color: #88879E;
border-color: #88879E;
}
.severity--low {
border-color: #88879E;
}
.severity--medium {
border-color: #D68000;
}
.severity--high {
border-color: #CE5019;
}
.severity--critical {
border-color: #AB1A1A;
}
.card--vuln {
padding-top: 4em;
}
.card--vuln .label {
left: 0;
position: absolute;
top: 1.1em;
padding-left: 1.9em;
padding-right: 1.9em;
border-radius: 0 0.25rem 0.25rem 0;
}
.card--vuln .card__section h2 {
font-size: 22px;
margin-bottom: 0.5em;
}
.card--vuln .card__section p {
margin: 0 0 0.5em 0;
}
.card--vuln .card__meta {
padding: 0 0 0 1em;
margin: 0;
font-size: 1.1em;
}
.card .card__meta__paths {
font-size: 0.9em;
}
.card--vuln .card__title {
font-size: 28px;
margin-top: 0;
}
.card--vuln .card__cta p {
margin: 0;
text-align: right;
}
.source-panel {
clear: both;
display: flex;
justify-content: flex-start;
flex-direction: column;
align-items: flex-start;
padding: 0.5em 0;
width: fit-content;
}
</style>
<style type="text/css">
.metatable {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
margin-top: 12px;
border-collapse: collapse;
border-spacing: 0;
font-variant-numeric: tabular-nums;
max-width: 51.75em;
}
tbody {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
flex-wrap: wrap;
}
.meta-row {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
outline: none;
text-align: left;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
display: flex;
align-items: start;
border-top: 1px solid #d3d3d9;
padding: 8px 0 0 0;
border-bottom: none;
margin: 8px;
width: 47.75%;
}
.meta-row-label {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
color: #4c4a73;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
margin: 0;
outline: none;
text-decoration: none;
z-index: auto;
align-self: start;
flex: 1;
font-size: 1rem;
line-height: 1.5rem;
padding: 0;
text-align: left;
vertical-align: top;
text-transform: none;
letter-spacing: 0;
}
.meta-row-value {
text-size-adjust: 100%;
-webkit-font-smoothing: antialiased;
-webkit-box-direction: normal;
color: inherit;
font-feature-settings: "pnum";
border-collapse: collapse;
border-spacing: 0;
word-break: break-word;
box-sizing: border-box;
background: transparent;
border: 0;
font: inherit;
font-size: 100%;
margin: 0;
outline: none;
padding: 0;
text-align: right;
text-decoration: none;
vertical-align: baseline;
z-index: auto;
}
</style>
</head>
<body class="section-projects">
<main class="layout-stacked">
<div class="layout-stacked__header header">
<header class="project__header">
<div class="layout-container">
<a class="brand" href="https://snyk.io" title="Snyk">
<svg width="68px" height="35px" viewBox="0 0 68 35" version="1.1" xmlns="http://www.w3.org/2000/svg" role="img">
<title>Snyk - Open Source Security</title>
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g fill="#fff">
<path d="M5.732,27.278 C3.445,27.278 1.589,26.885 0,26.124 L0.483,22.472 C2.163,23.296 4.056,23.689 5.643,23.689 C6.801,23.689 7.563,23.295 7.563,22.599 C7.563,20.594 0.333,21.076 0.333,15.839 C0.333,12.491 3.407,10.729 7.259,10.729 C9.179,10.729 11.161,11.249 12.444,11.704 L11.924,15.294 C10.577,14.774 8.747,14.291 7.222,14.291 C6.282,14.291 5.518,14.621 5.518,15.231 C5.518,17.208 12.903,16.815 12.903,21.925 C12.903,25.325 9.877,27.277 5.733,27.277 L5.732,27.278 Z M25.726,26.936 L25.726,17.894 C25.726,15.827 24.811,14.85 23.069,14.85 C22.219,14.85 21.329,15.09 20.719,15.46 L20.719,26.936 L15.352,26.936 L15.352,11.262 L20.602,10.83 L20.474,13.392 L20.652,13.392 C21.784,11.87 23.702,10.716 25.992,10.716 C28.736,10.716 31.112,12.416 31.112,16.436 L31.112,26.936 L25.724,26.936 L25.726,26.936 Z M61.175,26.936 L56.879,19.479 L56.446,19.479 L56.446,26.935 L51.082,26.935 L51.082,8.37 L56.447,0 L56.447,17.323 C57.515,16.017 61.112,11.059 61.112,11.059 L67.732,11.059 L61.454,17.689 L67.949,26.95 L61.175,26.95 L61.175,26.938 L61.175,26.936 Z M44.13,11.11 L41.93,18.262 C41.5,19.606 41.08,22.079 41.08,22.079 C41.08,22.079 40.75,19.516 40.292,18.172 L37.94,11.108 L31.928,11.108 L38.462,26.935 C37.572,29.04 36.199,30.815 34.369,30.815 C34.039,30.815 33.709,30.802 33.389,30.765 L31.255,34.061 C31.928,34.441 33.212,34.835 34.737,34.835 C38.703,34.835 41.359,31.627 43.215,26.885 L49.443,11.108 L44.132,11.108 L44.13,11.11 Z"></path>
</g>
</g>
</svg>
</a>
<div class="header-wrap">
<h1 class="project__header__title">Snyk test report</h1>
<p class="timestamp">June 25th 2023, 12:21:53 am (UTC+00:00)</p>
</div>
<div class="source-panel">
<span>Scanned the following path:</span>
<ul>
<li class="paths">redis:7.0.11-alpine (apk)</li>
</ul>
</div>
<div class="meta-counts">
<div class="meta-count"><span>0</span> <span>known vulnerabilities</span></div>
<div class="meta-count"><span>0 vulnerable dependency paths</span></div>
<div class="meta-count"><span>18</span> <span>dependencies</span></div>
</div><!-- .meta-counts -->
</div><!-- .layout-container--short -->
</header><!-- .project__header -->
</div><!-- .layout-stacked__header -->
<section class="layout-container">
<table class="metatable">
<tbody>
<tr class="meta-row"><th class="meta-row-label">Project</th> <td class="meta-row-value">docker-image|redis</td></tr>
<tr class="meta-row"><th class="meta-row-label">Path</th> <td class="meta-row-value">redis:7.0.11-alpine</td></tr>
<tr class="meta-row"><th class="meta-row-label">Package Manager</th> <td class="meta-row-value">apk</td></tr>
</tbody>
</table>
</section>
<div class="layout-container" style="padding-top: 35px;">
No known vulnerabilities detected.
</div>
</main><!-- .layout-stacked__content -->
</body>
</html>

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

Some files were not shown because too many files have changed in this diff Show More