Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/defaultbackend/main.go

@@ -25,19 +25,40 @@ import (
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	defaultBackendAnnotation = "default-backend"
+)
+
+var defaultBackendAnnotations = parser.Annotation{
+	Group: "backend",
+	Annotations: parser.AnnotationFields{
+		defaultBackendAnnotation: {
+			Validator: parser.ValidateServiceName,
+			Scope:     parser.AnnotationScopeLocation,
+			Risk:      parser.AnnotationRiskLow,
+			Documentation: `This service will be used to handle the response when the configured service in the Ingress rule does not have any active endpoints. 
+			It will also be used to handle the error responses if both this annotation and the custom-http-errors annotation are set.`,
+		},
+	},
+}
+
 type backend struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // NewParser creates a new default backend annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return backend{r}
+	return backend{
+		r:                r,
+		annotationConfig: defaultBackendAnnotations,
+	}
 }
 
 // Parse parses the annotations contained in the ingress to use
 // a custom default backend
 func (db backend) Parse(ing *networking.Ingress) (interface{}, error) {
-	s, err := parser.GetStringAnnotation("default-backend", ing)
+	s, err := parser.GetStringAnnotation(defaultBackendAnnotation, ing, db.annotationConfig.Annotations)
 	if err != nil {
 		return nil, err
 	}
@@ -50,3 +71,12 @@ func (db backend) Parse(ing *networking.Ingress) (interface{}, error) {
 
 	return svc, nil
 }
+
+func (db backend) GetDocumentation() parser.AnnotationFields {
+	return db.annotationConfig.Annotations
+}
+
+func (a backend) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, defaultBackendAnnotations.Annotations)
+}

internal/ingress/annotations/defaultbackend/main_test.go

@@ -91,21 +91,51 @@ func (m mockService) GetService(name string) (*api.Service, error) {
 func TestAnnotations(t *testing.T) {
 	ing := buildIngress()
 
-	data := map[string]string{}
-	data[parser.GetAnnotationWithPrefix("default-backend")] = "demo-service"
-	ing.SetAnnotations(data)
-
-	fakeService := &mockService{}
-	i, err := NewParser(fakeService).Parse(ing)
-	if err != nil {
-		t.Errorf("unexpected error %v", err)
+	tests := map[string]struct {
+		expectErr   bool
+		serviceName string
+	}{
+		"valid name": {
+			serviceName: "demo-service",
+			expectErr:   false,
+		},
+		"not in backend": {
+			serviceName: "demo1-service",
+			expectErr:   true,
+		},
+		"invalid dns name": {
+			serviceName: "demo-service.something.tld",
+			expectErr:   true,
+		},
+		"invalid name": {
+			serviceName: "something/xpto",
+			expectErr:   true,
+		},
+		"invalid characters": {
+			serviceName: "something;xpto",
+			expectErr:   true,
+		},
 	}
 
-	svc, ok := i.(*api.Service)
-	if !ok {
-		t.Errorf("expected *api.Service but got %v", svc)
-	}
-	if svc.Name != "demo-service" {
-		t.Errorf("expected %v but got %v", "demo-service", svc.Name)
+	for _, test := range tests {
+		data := map[string]string{}
+		data[parser.GetAnnotationWithPrefix(defaultBackendAnnotation)] = test.serviceName
+		ing.SetAnnotations(data)
+
+		fakeService := &mockService{}
+		i, err := NewParser(fakeService).Parse(ing)
+		if (err != nil) != test.expectErr {
+			t.Errorf("expected error: %t got error: %t err value: %s. %+v", test.expectErr, err != nil, err, i)
+		}
+
+		if !test.expectErr {
+			svc, ok := i.(*api.Service)
+			if !ok {
+				t.Errorf("expected *api.Service but got %v", svc)
+			}
+			if svc.Name != test.serviceName {
+				t.Errorf("expected %v but got %v", test.serviceName, svc.Name)
+			}
+		}
 	}
 }