Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/xforwardedprefix/main.go

@@ -23,17 +23,46 @@ import (
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	xForwardedForPrefixAnnotation = "x-forwarded-prefix"
+)
+
+var xForwardedForAnnotations = parser.Annotation{
+	Group: "backend",
+	Annotations: parser.AnnotationFields{
+		xForwardedForPrefixAnnotation: {
+			Validator:     parser.ValidateRegex(*parser.BasicCharsRegex, true),
+			Scope:         parser.AnnotationScopeLocation,
+			Risk:          parser.AnnotationRiskLow, // Low, as it allows regexes but on a very limited set
+			Documentation: `This annotation can be used to add the non-standard X-Forwarded-Prefix header to the upstream request with a string value`,
+		},
+	},
+}
+
 type xforwardedprefix struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // NewParser creates a new xforwardedprefix annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return xforwardedprefix{r}
+	return xforwardedprefix{
+		r:                r,
+		annotationConfig: xForwardedForAnnotations,
+	}
 }
 
 // Parse parses the annotations contained in the ingress rule
 // used to add an x-forwarded-prefix header to the request
 func (cbbs xforwardedprefix) Parse(ing *networking.Ingress) (interface{}, error) {
-	return parser.GetStringAnnotation("x-forwarded-prefix", ing)
+	return parser.GetStringAnnotation(xForwardedForPrefixAnnotation, ing, cbbs.annotationConfig.Annotations)
+}
+
+func (cbbs xforwardedprefix) GetDocumentation() parser.AnnotationFields {
+	return cbbs.annotationConfig.Annotations
+}
+
+func (a xforwardedprefix) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, xForwardedForAnnotations.Annotations)
 }

internal/ingress/annotations/xforwardedprefix/main_test.go

@@ -27,7 +27,7 @@ import (
 )
 
 func TestParse(t *testing.T) {
-	annotation := parser.GetAnnotationWithPrefix("x-forwarded-prefix")
+	annotation := parser.GetAnnotationWithPrefix(xForwardedForPrefixAnnotation)
 	ap := NewParser(&resolver.Mock{})
 	if ap == nil {
 		t.Fatalf("expected a parser.IngressAnnotation but returned nil")