OCPBUGS-27242: fix or ignore snyk errors for ocp storage repos

[dobsonj]

Ignore these two snyk errors. One is a hardcoded secret used in a unit test and nowhere else (it's not a real secret), the other is a complaint about the e2eprovider removing an existing socket before it creates a socket at that same path. Nothing in the core driver that runs on real clusters.

 ✗ [Low] Hardcoded Secret
   ID: cf46edb3-d35f-4887-855d-6ba6d11abeee 
   Path: pkg/util/secretutil/secret_test.go, line 104 
   Info: Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in keyPEM.
 ✗ [Low] Path Traversal
   ID: 9ad47a1a-2143-4d4f-b0fb-88ea459987f9 
   Path: test/e2eprovider/e2e_provider.go, line 54 
   Info: Unsanitized input from a CLI argument flows into os.Remove, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-secrets-store-csi-driver-main-security/1745954190951190528

/cc @openshift/storage

[openshift-ci-robot]

@dobsonj: This pull request references Jira Issue OCPBUGS-27242, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.16.0) matches configured target version for branch (4.16.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (wduan@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Ignore these two snyk errors. One is a hardcoded secret used in a unit test and nowhere else (it's not a real secret), the other is a complaint about the e2eprovider removing an existing socket before it creates a socket at that same path. Nothing in the core driver that runs on real clusters.

✗ [Low] Hardcoded Secret
  ID: cf46edb3-d35f-4887-855d-6ba6d11abeee 
  Path: pkg/util/secretutil/secret_test.go, line 104 
  Info: Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in keyPEM.
✗ [Low] Path Traversal
  ID: 9ad47a1a-2143-4d4f-b0fb-88ea459987f9 
  Path: test/e2eprovider/e2e_provider.go, line 54 
  Info: Unsanitized input from a CLI argument flows into os.Remove, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-secrets-store-csi-driver-main-security/1745954190951190528

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@dobsonj: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Ignore these two snyk errors. One is a hardcoded secret used in a unit test and nowhere else (it's not a real secret), the other is a complaint about the e2eprovider removing an existing socket before it creates a socket at that same path. Nothing in the core driver that runs on real clusters.

✗ [Low] Hardcoded Secret
  ID: cf46edb3-d35f-4887-855d-6ba6d11abeee 
  Path: pkg/util/secretutil/secret_test.go, line 104 
  Info: Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in keyPEM.
✗ [Low] Path Traversal
  ID: 9ad47a1a-2143-4d4f-b0fb-88ea459987f9 
  Path: test/e2eprovider/e2e_provider.go, line 54 
  Info: Unsanitized input from a CLI argument flows into os.Remove, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-secrets-store-csi-driver-main-security/1745954190951190528

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dobsonj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dobsonj: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[jsafrane]

/lgtm

[openshift-ci-robot]

@dobsonj: Jira Issue OCPBUGS-27242: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

• openshift/vmware-vsphere-csi-driver-operator#213 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-27242 has not been moved to the MODIFIED state.

Details

In response to this:

Ignore these two snyk errors. One is a hardcoded secret used in a unit test and nowhere else (it's not a real secret), the other is a complaint about the e2eprovider removing an existing socket before it creates a socket at that same path. Nothing in the core driver that runs on real clusters.

✗ [Low] Hardcoded Secret
  ID: cf46edb3-d35f-4887-855d-6ba6d11abeee 
  Path: pkg/util/secretutil/secret_test.go, line 104 
  Info: Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in keyPEM.
✗ [Low] Path Traversal
  ID: 9ad47a1a-2143-4d4f-b0fb-88ea459987f9 
  Path: test/e2eprovider/e2e_provider.go, line 54 
  Info: Unsanitized input from a CLI argument flows into os.Remove, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

from https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/47618/rehearse-47618-pull-ci-openshift-secrets-store-csi-driver-main-security/1745954190951190528

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-robot]

Fix included in accepted release 4.16.0-0.nightly-2024-01-21-092529