Skip to content

Fix information disclosure #11959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 8, 2025

Conversation

bbaassssiiee
Copy link
Contributor

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flake

What this PR does / why we need it:
The download.url could contain username and password when using private file repositories.
That will be in the logs. Use unsafe_show_logs to override.

Which issue(s) this PR fixes:

Fixes #11958

Special notes for your reviewer:
There is more discussion about private file repos in #10294

Does this PR introduce a user-facing change?:

File download.url's are masked unless the extra var unsafe_show_logs is true.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Feb 7, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @bbaassssiiee. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Feb 7, 2025
@yankay
Copy link
Member

yankay commented Feb 8, 2025

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 8, 2025
Copy link
Member

@tico88612 tico88612 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 8, 2025
@yankay
Copy link
Member

yankay commented Feb 8, 2025

Thanks @bbaassssiiee
/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bbaassssiiee, tico88612, yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 8, 2025
@k8s-ci-robot k8s-ci-robot merged commit c557adf into kubernetes-sigs:master Feb 8, 2025
43 checks passed
@tico88612
Copy link
Member

We'll have to remind other PRs to write the commit message correctly. 😂

image

clyhtsuriva added a commit to clyhtsuriva/kubespray that referenced this pull request Feb 16, 2025
commit d7962fb
Author: Jan Breitkopf <[email protected]>
Date:   Sat Feb 15 13:16:20 2025 +0100

    fix quotations in dhclient hooks (kubernetes-sigs#11946)

commit dbb9900
Author: Moritz Graf <[email protected]>
Date:   Fri Feb 14 16:56:24 2025 +0100

    Update main.yml (kubernetes-sigs#11943)

    Adding single quotees around parameters in crictl.

commit e24216b
Author: Max Gautier <[email protected]>
Date:   Fri Feb 14 09:28:21 2025 +0100

    Automatically derive defaults versions from checksums (kubernetes-sigs#11906)

    * Automatically derive defaults versions from checksums

    Currently, when updating checksums, we manually update the default
    versions.
    However, AFAICT, for all components where we have checksums, we're using
    the newest version out of those checksums.

    Codify this in the `_version` defaults variables definition to make the
    process automatic and reduce manual steps (as well as  the diff size
    during reviews).

    We assume the versions are sorted, with newest first. This should be
    guaranteed by the pre-commit hooks.

    * Validate checksums are ordered by versions, newest first

    * Generalize render-readme-versions hook for other static files

    The pre-commit hook introduced a142f40 (Update versions in README.md
    with pre-commit, 2025-01-21) allow to update our README with new
    versions.
    It turns out other "static" files (== which don't interpret Ansible
    variables) also use the default version (in that case, our Dockefiles,
    but there might be others)
    The Dockerfile breaks if the variable they use (`kube_version`) is a
    Jinja template.

    For helping with automatic version upgrade, generalize the hook to deal
    with other static files, and make a template out of the Dockerfile.

    * Dockerfile: template kube_version with pre-commit instead of runtime

    * Validate all versions/checksums are strings in pre-commit

    All the ansible/python tooling for version is for version strings. YAML
    unhelpfully consider some stuff as number, so enforce this.

    * Stringify checksums versions

commit a51e7dd
Author: Boris <[email protected]>
Date:   Tue Feb 11 14:37:58 2025 +0300

    refact ip stack (kubernetes-sigs#11953)

commit c557adf
Author: Bas <[email protected]>
Date:   Sat Feb 8 12:01:55 2025 +0100

    bugfix (kubernetes-sigs#11959)

commit d10a2cd
Author: Ali Afsharzadeh <[email protected]>
Date:   Sat Feb 8 06:41:57 2025 +0330

    Update load balancers versions to Nginx 1.27, Haproxy 3.1 (kubernetes-sigs#11928)

commit cfad1bd
Author: Raul Butuc <[email protected]>
Date:   Fri Feb 7 17:09:55 2025 +0200

    Fix incorrect syntax for secondary nodelocaldns manifest (kubernetes-sigs#11952)

    * Fix incorrect syntax

    * Fix incorrect syntax

commit 08b77b5
Author: Kay Yan <[email protected]>
Date:   Thu Feb 6 19:53:56 2025 +0800

    Fix CI by exclude the `.ansible` in `.ansible-lint` &  remove `ctr image pull` workaround (kubernetes-sigs#11948)

    * exclude .ansible in ansible-lint

    * remote ctr i pull workdaround

    Signed-off-by: Kay Yan <[email protected]>

    ---------

    Signed-off-by: Kay Yan <[email protected]>

commit fe0a1f4
Author: Mohamed Omar Zaian <[email protected]>
Date:   Wed Feb 5 09:50:16 2025 +0100

    Bump nerdctl to v2.0.3 (kubernetes-sigs#11913)

commit 624937d
Author: Mohamed Omar Zaian <[email protected]>
Date:   Wed Feb 5 08:32:15 2025 +0100

    [containerd] Support containerd v2.0.x (kubernetes-sigs#11845)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Information disclosure when using private file repos
4 participants