Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of Fix CLI panic caused by single backslash values into release/1.9.x #14738

Merged
merged 3 commits into from Mar 29, 2022

Conversation

hc-github-team-secure-vault-core
Copy link
Collaborator

Backport

This PR is auto-generated from #14523 to be assessed for backporting due to the inclusion of the label backport/1.9.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

The below text is copied from the body of the original PR.


Passing key=value fields whose value is a single backslash to the CLI will cause a panic. The underlying cause exists in go-secure-stdlib/kv-builder. A fix has been introduced in go-secure-stdlib/kv-builder PR #35.

This PR introduces the following changes:

  • Upgrade go-secure-stdlib/kv-builder to v0.1.2
  • Add a KV test to ensure that single backslash values do not panic

Before change:

❯ vault kv put secret/foo 'bar=\'
panic: runtime error: index out of range [1] with length 1

goroutine 1 [running]:
github.com/hashicorp/go-secure-stdlib/kv-builder.(*Builder).add(0xc0008cb440, {0x7ffeefbff898, 0x11880ee8})
        /Users/ccapurso/go/pkg/mod/github.com/hashicorp/go-secure-stdlib/kv-builder@v0.1.1/builder.go:94 +0x832
github.com/hashicorp/go-secure-stdlib/kv-builder.(*Builder).Add(0x7ffeefbff88d, {0xc0001a6040, 0x1, 0x484dde5})
        /Users/ccapurso/go/pkg/mod/github.com/hashicorp/go-secure-stdlib/kv-builder@v0.1.1/builder.go:32 +0x89
github.com/hashicorp/vault/command.parseArgsData({0x6449e40, 0xc000194000}, {0xc0001a6040, 0x1, 0x1})
        /Users/ccapurso/git/vault/command/base_helpers.go:134 +0xaa
github.com/hashicorp/vault/command.(*KVPutCommand).Run(0xc0008cab20, {0xc0001a6030, 0x2, 0x2})
        /Users/ccapurso/git/vault/command/kv_put.go:120 +0x171
github.com/mitchellh/cli.(*CLI).Run(0xc000145cc0)
        /Users/ccapurso/go/pkg/mod/github.com/mitchellh/cli@v1.1.2/cli.go:262 +0x5f8
github.com/hashicorp/vault/command.RunCustom({0xc0001a6010, 0x4, 0x4}, 0xc0000001a0)
        /Users/ccapurso/git/vault/command/main.go:180 +0x9f7
github.com/hashicorp/vault/command.Run(...)
        /Users/ccapurso/git/vault/command/main.go:88
main.main()
        /Users/ccapurso/git/vault/main.go:10 +0x52

After change:

❯ vault kv put secret/foo 'bar=\'
= Secret Path =
secret/data/foo

======= Metadata =======
Key                Value
---                -----
created_time       2022-03-15T14:38:07.024316Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1
❯ vault kv get secret/foo
= Secret Path =
secret/data/foo

======= Metadata =======
Key                Value
---                -----
created_time       2022-03-15T14:38:07.024316Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1

=== Data ===
Key    Value
---    -----
bar    \

@HridoyRoy HridoyRoy self-requested a review March 28, 2022 15:32
Copy link
Contributor

@HridoyRoy HridoyRoy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changelog and test isn't backported -- were they merged into 1.9 via another PR?

@vercel vercel bot temporarily deployed to Preview – vault March 28, 2022 17:44 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 28, 2022 17:44 Inactive
@ccapurso ccapurso force-pushed the backport/vault-4242/radically-modest-swift branch from 9f93f88 to eb44781 Compare March 28, 2022 18:09
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 28, 2022 18:09 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 28, 2022 18:09 Inactive
(cherry picked from commit d900535)
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 29, 2022 13:39 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 29, 2022 13:39 Inactive
@ccapurso
Copy link
Contributor

The changelog and test isn't backported -- were they merged into 1.9 via another PR?

Nope, not sure why the cherry-picks failed but I brought them over manually.

@ccapurso ccapurso requested a review from HridoyRoy March 29, 2022 13:40
@ccapurso ccapurso merged commit af6b578 into release/1.9.x Mar 29, 2022
@ccapurso ccapurso deleted the backport/vault-4242/radically-modest-swift branch March 29, 2022 14:41
akshya96 pushed a commit that referenced this pull request Mar 29, 2022
…ase/1.9.x (#14738)

* backport of commit fb51de1

* add kv test to ensure single backslash values no longer panic

(cherry picked from commit cd61f31)

* add changelog entry

(cherry picked from commit d900535)

Co-authored-by: Chris Capurso <1036769+ccapurso@users.noreply.github.com>
akshya96 pushed a commit that referenced this pull request Mar 29, 2022
…ase/1.9.x (#14738)

* backport of commit fb51de1

* add kv test to ensure single backslash values no longer panic

(cherry picked from commit cd61f31)

* add changelog entry

(cherry picked from commit d900535)

Co-authored-by: Chris Capurso <1036769+ccapurso@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants