Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: handle empty spec for modifyset #2585

Merged
merged 5 commits into from
Feb 22, 2023
+39 −4
Merged

fix: handle empty spec for modifyset #2585

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3a5b564
fix: handle empty spec for modifyset
acpana Feb 16, 2023
1c48f77
Merge branch 'master' into acpana/fix-panic
acpana Feb 17, 2023
5b2d7a9
Merge branch 'master' into acpana/fix-panic
acpana Feb 18, 2023
89f4afe
Merge branch 'master' into acpana/fix-panic
acpana Feb 19, 2023
806e1e9
Merge branch 'master' into acpana/fix-panic
maxsmythe Feb 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions pkg/mutation/mutators/assign/assign_mutator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"github.com/open-policy-agent/gatekeeper/pkg/mutation/match"
path "github.com/open-policy-agent/gatekeeper/pkg/mutation/path/tester"
"github.com/open-policy-agent/gatekeeper/pkg/mutation/types"
"github.com/stretchr/testify/require"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
Expand Down Expand Up @@ -1070,3 +1071,12 @@ func nestedMapSlice(u map[string]interface{}, fields ...string) ([]map[string]in
}
return out, nil
}

// Tests the Assign mutator MutatorForAssign call with an empty spec for graceful handling.
func Test_Assign_emptySpec(t *testing.T) {
assign := &mutationsunversioned.Assign{}
mutator, err := MutatorForAssign(assign)

require.ErrorContains(t, err, "empty path")
require.Nil(t, mutator)
}
10 changes: 10 additions & 0 deletions pkg/mutation/mutators/assignmeta/assignmeta_mutator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned"
"github.com/open-policy-agent/gatekeeper/pkg/externaldata"
"github.com/open-policy-agent/gatekeeper/pkg/mutation/types"
"github.com/stretchr/testify/require"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)
Expand Down Expand Up @@ -107,3 +108,12 @@ func TestAssignMetadata(t *testing.T) {
})
}
}

// Tests the AssignMeta mutator MutatorForAssignMetadata call with an empty spec for graceful handling.
func Test_AssignMeta_emptySpec(t *testing.T) {
assignMeta := &unversioned.AssignMetadata{}
mutator, err := MutatorForAssignMetadata(assignMeta)

require.ErrorContains(t, err, "invalid location for assignmetadat")
require.Nil(t, mutator)
}
2 changes: 1 addition & 1 deletion pkg/mutation/mutators/modifyset/modify_set_mutator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ func MutatorForModifySet(modifySet *mutationsunversioned.ModifySet) (*Mutator, e
return nil, fmt.Errorf("modifyset %s can't change metadata", modifySet.GetName())
}

if path.Nodes[len(path.Nodes)-1].Type() == parser.ListNode {
if len(path.Nodes) > 0 && path.Nodes[len(path.Nodes)-1].Type() == parser.ListNode {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

empty spec leads to empty path which panics. I've added unit tests for all mutators that don't have an empty spec test case to enforce graceful handling of an empty spec.

return nil, fmt.Errorf("final node in a modifyset location cannot be a keyed list")
}

Expand Down
4 changes: 1 addition & 3 deletions pkg/mutation/mutators/modifyset/modify_set_mutator_benchmark_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import (
)

func modifyset(value interface{}, location string) *unversioned.ModifySet {
result := &unversioned.ModifySet{
return &unversioned.ModifySet{
Spec: unversioned.ModifySetSpec{
ApplyTo: []match.ApplyTo{{
Groups: []string{"*"},
Expand All @@ -29,8 +29,6 @@ func modifyset(value interface{}, location string) *unversioned.ModifySet {
},
},
}

return result
}

func benchmarkModifySetMutator(b *testing.B, n int) {
Expand Down
17 changes: 17 additions & 0 deletions pkg/mutation/mutators/modifyset/modify_set_mutator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package modifyset

import (
"testing"

mutationsunversioned "github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned"
"github.com/stretchr/testify/require"
)

// Tests the ModifySet mutator MutatorForModifySet call with an empty spec for graceful handling.
func Test_ModifySet_emptySpec(t *testing.T) {
modifySet := &mutationsunversioned.ModifySet{}
mutator, err := MutatorForModifySet(modifySet)

require.ErrorContains(t, err, "applyTo required for ModifySet mutator")
require.Nil(t, mutator)
}