Repository navigation
Conversation
… prevent panics and shell injection on malformed VCAP_SERVICES Three related correctness issues in the Contrast Security hook: 1. Service credential extraction operated on the first entry in a category, not on the entry that actually matched "contrast-security". When a non-Contrast user-provided service appeared before the Contrast one in the same category, the wrong credentials would be returned. Fixed by replacing the two-pass category+loop approach with a single per-service loop. 2. Add basic shell escaping for credential values interpolated into `export` statements. 3. Use the comma-ok idiom to prevent panic if VCAP_SERVICES binding contains unexpected types.
Contrast teamserver displays the Contrast Agent URL with the /Contrast suffix by default nowadays. The hook unconditionally appended /Contrast/ to the teamserver_url from the service binding. If the URL already included that path, the resulting CONTRAST__API__URL would be malformed. The URL is now normalised: trailing slashes are stripped, then /Contrast is appended only if not already present. The trailing slash is dropped as it is not required by the agent.
…I__TOKEN) The Contrast Node.js agent supports a newer API token that encodes all connection details (url, api_key, service_key, user_name) as a single base64 value. Previously only the legacy credential fields were read from VCAP_SERVICES and written to profile.d. Changes: - Add ApiToken field to ContrastSecurityCredentials; populated from the api_token key in the service binding credentials block. - Introduce writeExport() helper that omits a line entirely when the value is empty, replacing the previous unconditional string concat. - URL, API_KEY, SERVICE_KEY, and USER_NAME are only written when present; CONTRAST__API__TOKEN is written when api_token is present. - When both legacy credentials and api_token are provided, all vars are written and the agent applies its own precedence (legacy wins).
Cloud Foundry can deliver service bindings via a file instead of the VCAP_SERVICES environment variable when file-based VCAP services is enabled. In that mode VCAP_SERVICES is absent and VCAP_SERVICES_FILE_PATH points to a file with the same JSON structure. A new loadVcapServicesJSON() method checks VCAP_SERVICES_FILE_PATH first and falls back to the VCAP_SERVICES env var. When both are set, the file path takes precedence (it was explicitly enabled as a feature) and a warning is logged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A short explanation of the proposed change
This PR extends the Contrast Security Assess hook (
src/nodejs/hooks/contrast_security.go) with four improvements, each in its own commit:VCAP_SERVICESbindings; credential values were written into shell exports without quoting (here I reused the quoting approach from the BOSH CLI)./Contrastsuffix was appended unconditionally; ifteamserver_urlalready included it (which is the case when you copy it from the UI) the resultingCONTRAST__API__URLwas malformed.api_tokenfrom the service binding and writesCONTRAST__API__TOKEN. When both token and legacy credentials are present, all vars are emitted and the agent applies its own precedence.file-based-vcap-services, bindings arrive viaVCAP_SERVICES_FILE_PATHrather than the env var. The hook now checks that path first and falls back to the env var.An explanation of the use cases your change solves
/Contrastinteamserver_urlwere getting a double-suffixed URL, causing agent connection failures.api_tokeninstead of four separate fields) had no way to configure the agent through the buildpack and had to decode the token first to extract the individual fields.file-based-vcap-servicesenabled received no Contrast configuration because the hook only checkedVCAP_SERVICES.Checks
masterbranch