DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Controller: Several security fixes. (#13069)

Browse source 
Co-authored-by: Tabitha Sable <tabitha.c.sable@gmail.com>
This commit is contained in:
Marco Ebert 2025-03-25 00:00:39 +01:00 • committed by GitHub
parent cfd4d89a56
commit 626305229f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 36 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

4
internal/ingress/controller/controller.go
View file

@ -420,11 +420,15 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error {
return err
}
/* Deactivated to mitigate CVE-2025-1974
// TODO: Implement sandboxing so this test can be done safely
err = n.testTemplate(content)
if err != nil {
n.metricCollector.IncCheckErrorCount(ing.ObjectMeta.Namespace, ing.Name)
return err
}
*/
n.metricCollector.IncCheckCount(ing.ObjectMeta.Namespace, ing.Name)
endCheck := time.Now().UnixNano() / 1000000
n.metricCollector.SetAdmissionMetrics(

3
internal/ingress/controller/controller_test.go
View file

@ -250,6 +250,8 @@ func TestCheckIngress(t *testing.T) {
}
})
/* Deactivated to mitigate CVE-2025-1974
// TODO: Implement sandboxing so this test can be done safely
t.Run("When nginx test returns an error", func(t *testing.T) {
nginx.command = testNginxTestCommand{
t: t,
@ -261,6 +263,7 @@ func TestCheckIngress(t *testing.T) {
t.Errorf("with a new ingress with an error, an error should be returned")
}
})
*/
t.Run("When the default annotation prefix is used despite an override", func(t *testing.T) {
defer func() {

6
internal/ingress/controller/template/template.go
View file

@ -1627,11 +1627,11 @@ func buildMirrorLocations(locs []*ingress.Location) string {
mapped.Insert(loc.Mirror.Source)
buffer.WriteString(fmt.Sprintf(`location = %v {
internal;
proxy_set_header Host "%v";
proxy_pass "%v";
proxy_set_header Host %v;
proxy_pass %v;
}
`, loc.Mirror.Source, loc.Mirror.Host, loc.Mirror.Target))
`, strconv.Quote(loc.Mirror.Source), strconv.Quote(loc.Mirror.Host), strconv.Quote(loc.Mirror.Target)))
}
return buffer.String()