Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sec/helm index max size #4

Closed
wants to merge 2 commits into from
Closed

Sec/helm index max size #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1d07977
sec: limit helm index max size
pasha-codefresh Mar 14, 2024
9cfa9a7
sec: limit helm index max size
pasha-codefresh Mar 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cmd/argocd-repo-server/commands/argocd_repo_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
"github.com/argoproj/argo-cd/v2/reposerver/askpass"
reposervercache "github.com/argoproj/argo-cd/v2/reposerver/cache"
"github.com/argoproj/argo-cd/v2/reposerver/metrics"
"github.com/argoproj/argo-cd/v2/reposerver/repository"

Check failure on line 24 in cmd/argocd-repo-server/commands/argocd_repo_server.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

could not import github.com/argoproj/argo-cd/v2/reposerver/repository (-: # github.com/argoproj/argo-cd/v2/reposerver/repository
cacheutil "github.com/argoproj/argo-cd/v2/util/cache"
"github.com/argoproj/argo-cd/v2/util/cli"
"github.com/argoproj/argo-cd/v2/util/env"
Expand Down Expand Up @@ -68,6 +68,7 @@
streamedManifestMaxTarSize string
streamedManifestMaxExtractedSize string
helmManifestMaxExtractedSize string
helmRegistryMaxIndexSize string
disableManifestMaxExtractedSize bool
)
var command = cobra.Command{
Expand Down Expand Up @@ -110,6 +111,9 @@
helmManifestMaxExtractedSizeQuantity, err := resource.ParseQuantity(helmManifestMaxExtractedSize)
errors.CheckError(err)

helmRegistryMaxIndexSizeQuantity, err := resource.ParseQuantity(helmRegistryMaxIndexSize)
errors.CheckError(err)

askPassServer := askpass.NewServer()
metricsServer := metrics.NewMetricsServer()
cacheutil.CollectMetrics(redisClient, metricsServer)
Expand All @@ -125,6 +129,7 @@
StreamedManifestMaxExtractedSize: streamedManifestMaxExtractedSizeQuantity.ToDec().Value(),
StreamedManifestMaxTarSize: streamedManifestMaxTarSizeQuantity.ToDec().Value(),
HelmManifestMaxExtractedSize: helmManifestMaxExtractedSizeQuantity.ToDec().Value(),
HelmRegistryMaxIndexSize: helmRegistryMaxIndexSizeQuantity.ToDec().Value(),
}, askPassServer)
errors.CheckError(err)

Expand Down Expand Up @@ -208,6 +213,7 @@
command.Flags().StringVar(&streamedManifestMaxTarSize, "streamed-manifest-max-tar-size", env.StringFromEnv("ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE", "100M"), "Maximum size of streamed manifest archives")
command.Flags().StringVar(&streamedManifestMaxExtractedSize, "streamed-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of streamed manifest archives when extracted")
command.Flags().StringVar(&helmManifestMaxExtractedSize, "helm-manifest-max-extracted-size", env.StringFromEnv("ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE", "1G"), "Maximum size of helm manifest archives when extracted")
command.Flags().StringVar(&helmRegistryMaxIndexSize, "helm-registry-max-index-size", env.StringFromEnv("ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_INDEX_SIZE", "1G"), "Maximum size of registry index file")
command.Flags().BoolVar(&disableManifestMaxExtractedSize, "disable-helm-manifest-max-extracted-size", env.ParseBoolFromEnv("ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE", false), "Disable maximum size of helm manifest archives when extracted")
tlsConfigCustomizerSrc = tls.AddTLSFlagsToCmd(&command)
cacheSrc = reposervercache.AddCacheFlagsToCmd(&command, cacheutil.Options{
Expand Down
1 change: 1 addition & 0 deletions reposerver/repository/repository.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@
StreamedManifestMaxExtractedSize int64
StreamedManifestMaxTarSize int64
HelmManifestMaxExtractedSize int64
HelmRegistryMaxIndexSize int64
DisableHelmManifestMaxExtractedSize bool
}

Expand Down Expand Up @@ -2356,7 +2357,7 @@
return helmClient, version.String(), nil
}

index, err := helmClient.GetIndex(noRevisionCache)

Check failure on line 2360 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Check changes to generated code 

not enough arguments in call to helmClient.GetIndex

Check failure on line 2360 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Build & cache Go code 

not enough arguments in call to helmClient.GetIndex

Check failure on line 2360 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to helmClient.GetIndex

Check failure on line 2360 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to helmClient.GetIndex

Check failure on line 2360 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to helmClient.GetIndex
if err != nil {
return nil, "", err
}
Expand Down Expand Up @@ -2438,7 +2439,7 @@
}

func (s *Service) GetHelmCharts(ctx context.Context, q *apiclient.HelmChartsRequest) (*apiclient.HelmChartsResponse, error) {
index, err := s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds(), q.Repo.EnableOCI, q.Repo.Proxy, helm.WithChartPaths(s.chartPaths)).GetIndex(true)

Check failure on line 2442 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Check changes to generated code 

not enough arguments in call to s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds(), q.Repo.EnableOCI, q.Repo.Proxy, helm.WithChartPaths(s.chartPaths)).GetIndex

Check failure on line 2442 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Build & cache Go code 

not enough arguments in call to s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds(), q.Repo.EnableOCI, q.Repo.Proxy, helm.WithChartPaths(s.chartPaths)).GetIndex

Check failure on line 2442 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds(), q.Repo.EnableOCI, q.Repo.Proxy, helm.WithChartPaths(s.chartPaths)).GetIndex

Check failure on line 2442 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds(), q.Repo.EnableOCI, q.Repo.Proxy, helm.WithChartPaths(s.chartPaths)).GetIndex
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -2473,7 +2474,7 @@
_, err := helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI, repo.Proxy).TestHelmOCI()
return err
} else {
_, err := helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI, repo.Proxy).GetIndex(false)

Check failure on line 2477 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Check changes to generated code 

not enough arguments in call to helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI, repo.Proxy).GetIndex

Check failure on line 2477 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Build & cache Go code 

not enough arguments in call to helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI, repo.Proxy).GetIndex

Check failure on line 2477 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI, repo.Proxy).GetIndex

Check failure on line 2477 in reposerver/repository/repository.go

View workflow job for this annotation

GitHub Actions / Lint Go code 

not enough arguments in call to helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI, repo.Proxy).GetIndex
return err
}
},
Expand Down
10 changes: 5 additions & 5 deletions util/helm/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ type indexCache interface {
type Client interface {
CleanChartCache(chart string, version string) error
ExtractChart(chart string, version string, passCredentials bool, manifestMaxExtractedSize int64, disableManifestMaxExtractedSize bool) (string, argoio.Closer, error)
GetIndex(noCache bool) (*Index, error)
GetIndex(noCache bool, maxIndexSize int64) (*Index, error)
GetTags(chart string, noCache bool) (*TagsList, error)
TestHelmOCI() (bool, error)
}
Expand Down Expand Up @@ -227,7 +227,7 @@ func (c *nativeHelmChart) ExtractChart(chart string, version string, passCredent
}), nil
}

func (c *nativeHelmChart) GetIndex(noCache bool) (*Index, error) {
func (c *nativeHelmChart) GetIndex(noCache bool, maxIndexSize int64) (*Index, error) {
indexLock.Lock(c.repoURL)
defer indexLock.Unlock(c.repoURL)

Expand All @@ -241,7 +241,7 @@ func (c *nativeHelmChart) GetIndex(noCache bool) (*Index, error) {
if len(data) == 0 {
start := time.Now()
var err error
data, err = c.loadRepoIndex()
data, err = c.loadRepoIndex(maxIndexSize)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -294,7 +294,7 @@ func (c *nativeHelmChart) TestHelmOCI() (bool, error) {
return true, nil
}

func (c *nativeHelmChart) loadRepoIndex() ([]byte, error) {
func (c *nativeHelmChart) loadRepoIndex(maxIndexSize int64) ([]byte, error) {
indexURL, err := getIndexURL(c.repoURL)
if err != nil {
return nil, err
Expand Down Expand Up @@ -329,7 +329,7 @@ func (c *nativeHelmChart) loadRepoIndex() ([]byte, error) {
if resp.StatusCode != http.StatusOK {
return nil, errors.New("failed to get index: " + resp.Status)
}
return io.ReadAll(resp.Body)
return io.ReadAll(io.LimitReader(resp.Body, maxIndexSize))
}

func newTLSConfig(creds Creds) (*tls.Config, error) {
Expand Down
14 changes: 10 additions & 4 deletions util/helm/client_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,12 @@ func (f *fakeIndexCache) GetHelmIndex(_ string, indexData *[]byte) error {
func TestIndex(t *testing.T) {
t.Run("Invalid", func(t *testing.T) {
client := NewClient("", Creds{}, false, "")
_, err := client.GetIndex(false)
_, err := client.GetIndex(false, 10000)
assert.Error(t, err)
})
t.Run("Stable", func(t *testing.T) {
client := NewClient("https://argoproj.github.io/argo-helm", Creds{}, false, "")
index, err := client.GetIndex(false)
index, err := client.GetIndex(false, 10000)
assert.NoError(t, err)
assert.NotNil(t, index)
})
Expand All @@ -50,7 +50,7 @@ func TestIndex(t *testing.T) {
Username: "my-password",
Password: "my-username",
}, false, "")
index, err := client.GetIndex(false)
index, err := client.GetIndex(false, 10000)
assert.NoError(t, err)
assert.NotNil(t, index)
})
Expand All @@ -62,12 +62,18 @@ func TestIndex(t *testing.T) {
require.NoError(t, err)

client := NewClient("https://argoproj.github.io/argo-helm", Creds{}, false, "", WithIndexCache(&fakeIndexCache{data: data.Bytes()}))
index, err := client.GetIndex(false)
index, err := client.GetIndex(false, 10000)

assert.NoError(t, err)
assert.Equal(t, fakeIndex, *index)
})

t.Run("Limited", func(t *testing.T) {
client := NewClient("https://argoproj.github.io/argo-helm", Creds{}, false, "")
_, err := client.GetIndex(false, 100)

assert.ErrorContains(t, err, "unexpected end of stream")
})
}

func Test_nativeHelmChart_ExtractChart(t *testing.T) {
Expand Down
Loading