mirror of
https://github.com/argoproj/argo-cd.git
synced 2026-02-20 01:28:45 +01:00
41 lines
1.7 KiB
Plaintext
41 lines
1.7 KiB
Plaintext
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
|
|
version: v1.22.1
|
|
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
|
|
ignore:
|
|
SNYK-JS-ANSIREGEX-1583908:
|
|
- '*':
|
|
reason: >-
|
|
Code is only run client-side in the swagger-ui endpoint. No risk of
|
|
server-side DoS.
|
|
SNYK-CC-K8S-44:
|
|
- 'manifests/core-install.yaml > *':
|
|
reason: >-
|
|
Argo CD needs wide permissions to manage resources.
|
|
- 'manifests/install.yaml > *':
|
|
reason: >-
|
|
Argo CD needs wide permissions to manage resources.
|
|
SNYK-JS-MOMENT-2440688:
|
|
- '*':
|
|
reason: >-
|
|
Code is only run client-side. No risk of directory traversal.
|
|
SNYK-GOLANG-GITHUBCOMEMICKLEIGORESTFUL-2435653:
|
|
- '*':
|
|
reason: >-
|
|
Argo CD uses go-restful as a transitive dependency of kube-openapi. kube-openapi is used to generate openapi
|
|
specs. We do not use go-restul at runtime and are therefore not vulnerable to this CORS misconfiguration
|
|
issue in go-restful.
|
|
SNYK-JS-FORMIDABLE-2838956:
|
|
- '*':
|
|
reason: >-
|
|
Code is only run client-side. No risk of arbitrary file upload.
|
|
SNYK-JS-PARSEPATH-2936439:
|
|
- '*':
|
|
reason: >-
|
|
The issue is that, for specific URLs, parse-path may incorrectly identify the "resource" (domain name)
|
|
portion. For example, in "http://127.0.0.1#@example.com", it identifies "example.com" as the "resource".
|
|
|
|
We use parse-path on the client side, but permissions for git URLs are checked server-side. This is a
|
|
potential usability issue, but it is not a security issue.
|
|
patch: {}
|
|
|