Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security] Secvuln 8633 Consul configuration allowed repeated keys #21908

Open
wants to merge 13 commits into
base: main
Choose a base branch
from
Open

[Security] Secvuln 8633 Consul configuration allowed repeated keys #21908

wants to merge 13 commits into from
+81 −27

Conversation

sarahalsmiller
Copy link
Member

Description

  • Due to a known issue in hcl v1,
  • There is a potential for old unparsed rules to be in the cache, so I added an optional route to replicate the old behavior to maintain backwards compatibility when reading unparsed policies from the cache.

Testing & Reproduction steps

  • New tests pass

Links

hashicorp/hcl#704 Original HCL PR

PR Checklist

  • [ X] updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@sarahalsmiller sarahalsmiller added the backport/all Apply backports for all active releases per .release/versions.hcl label Oct 31, 2024
@sarahalsmiller sarahalsmiller requested a review from a team as a code owner October 31, 2024 16:17
@github-actions github-actions bot added theme/acls ACL and token generation pr/dependencies PR specifically updates dependencies of project labels Oct 31, 2024
@sarahalsmiller sarahalsmiller force-pushed the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch from 1938f0b to ead5aa5 Compare October 31, 2024 16:25
sarahalsmiller
sarahalsmiller commented Oct 31, 2024
View reviewed changes
acl/policy.go Outdated Show resolved Hide resolved
@sarahalsmiller sarahalsmiller force-pushed the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch from 4fce857 to f25341c Compare November 5, 2024 20:31
@sarahalsmiller sarahalsmiller force-pushed the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch from f25341c to 6160a2c Compare November 5, 2024 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dduzgun-security dduzgun-security Awaiting requested review from dduzgun-security

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
backport/all Apply backports for all active releases per .release/versions.hcl pr/dependencies PR specifically updates dependencies of project theme/acls ACL and token generation
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sarahalsmiller