Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow compute/app engine default service account ids in regex #1390

Merged
merged 1 commit into from
Apr 26, 2018
Merged

Allow compute/app engine default service account ids in regex #1390

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions google/validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ const (

RFC1035NameTemplate = "[a-z](?:[-a-z0-9]{%d,%d}[a-z0-9])"
CloudIoTIdRegex = "^[a-zA-Z][-a-zA-Z0-9._+~%]{2,254}$"

// Format of default Compute service accounts created by Google
// ${PROJECT_ID}[email protected] where PROJECT_ID is an int64 (max 20 digits)
ComputeServiceAccountNameRegex = "[0-9]{1,20}[email protected]"
)

var (
Expand All @@ -29,8 +33,20 @@ var (
// 4 and 28 since the first and last character are excluded.
ServiceAccountNameRegex = fmt.Sprintf(RFC1035NameTemplate, 4, 28)

ProjectNameInDNSFormRegex = "[-a-z0-9\\.]{1,63}"
ServiceAccountLinkRegex = "projects/" + ProjectRegex + "/serviceAccounts/" + ServiceAccountNameRegex + "@" + ProjectNameInDNSFormRegex + "\\.iam\\.gserviceaccount\\.com$"
ServiceAccountLinkRegexPrefix = "projects/" + ProjectRegex + "/serviceAccounts/"
PossibleServiceAccountNames = []string{
AppEngineServiceAccountNameRegex,
ComputeServiceAccountNameRegex,
CreatedServiceAccountNameRegex,
}
ServiceAccountLinkRegex = ServiceAccountLinkRegexPrefix + "(" + strings.Join(PossibleServiceAccountNames, "|") + ")"

// Format of service accounts created through the API
CreatedServiceAccountNameRegex = fmt.Sprintf(RFC1035NameTemplate, 4, 28) + "@" + ProjectNameInDNSFormRegex + "\\.iam\\.gserviceaccount\\.com$"
ProjectNameInDNSFormRegex = "[-a-z0-9\\.]{1,63}"

// Format of default App Engine service accounts created by Google
AppEngineServiceAccountNameRegex = ProjectRegex + "@appspot.gserviceaccount.com"
)

var rfc1918Networks = []string{
Expand Down
2 changes: 2 additions & 0 deletions google/validation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,8 @@ func TestValidateServiceAccountLink(t *testing.T) {
{TestName: "valid with dash", Value: "projects/my-project/serviceAccounts/[email protected]"},
{TestName: "valid with colon", Value: "projects/my:project/serviceAccounts/[email protected]"},
{TestName: "valid with dot and colon", Value: "projects/my.thing:project/serviceAccounts/[email protected]"},
{TestName: "valid with compute default service account", Value: "projects/my-project/serviceAccounts/[email protected]"},
{TestName: "valid with app engine default service account", Value: "projects/my-project/serviceAccounts/[email protected]"},

// Errors
{TestName: "multiple colons", Value: "projects/my:project:thing/serviceAccounts/[email protected]", ExpectError: true},
Expand Down