Skip to content

Commit fac0622

Browse files
IvanHuntersIvanHunters
committed
fix(postgres): make security denylist case-insensitive
PostgreSQL parameter names are case-insensitive, but the denylist check was case-sensitive, allowing bypass via mixed-case names (e.g., ARCHIVE_COMMAND instead of archive_command). Normalize parameter names to lowercase before checking against the denylist to prevent security bypass. Thanks to CodeRabbit for catching this security issue. Signed-off-by: IvanHunters <[email protected]>
1 parent 96c7c16 commit fac0622

2 files changed

Lines changed: 2 additions & 1 deletion

File tree

‎packages/apps/postgres/templates/db.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ spec:
6565
{{- /* Security: Block parameters that could allow shell command execution */ -}}
6666
{{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "log_destination" "event_source" }}
6767
{{- range $key, $value := $params }}
68-
{{- if has $key $dangerousParams }}
68+
{{- $normalizedKey := lower $key }}
69+
{{- if has $normalizedKey $dangerousParams }}
6970
{{- fail (printf "SECURITY: Parameter '%s' is blocked for security reasons. This parameter could allow arbitrary shell command execution and is managed by CloudNativePG operator." $key) }}
7071
{{- end }}
7172
{{ $key }}: {{ $value | quote }}

packages/system/kubevirt-operator/alerts/PrometheusRule.yaml renamed to packages/system/kubevirt-operator/templates/prometheusrule.yaml

File renamed without changes.

0 commit comments

Comments
 (0)