Conversation
- Enhanced IP address creation logging to show address source (spec vs status) - Verified all key reconcilers (IPAddress, Device, MACAddress) call update_tags_if_differ - Confirmed description and DNS name fields are compared in drift detection - Simplified device reconciler tag reconciliation flow - All Phase 1-3 fixes completed: IP address issues, tag reconciliation, field updates
- Created diagnose_missing_resources.py to investigate why resources aren't created - Checks CR existence, status, netbox_id, RBAC permissions - Provides actionable recommendations for each resource - Updated RECONCILIATION_DIFFERENCES_ANALYSIS.md with diagnostic tool usage
|
Hey there and thank you for opening this pull request! 👋 We require pull request titles to follow the We use the pull request title in automated release changelog updates, and would like our Details: |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| resources = rule.get("resources", []) | ||
| verbs = rule.get("verbs", []) | ||
|
|
||
| if "dcops.microscaler.io" in api_groups: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
In general, to fix incomplete URL/host substring sanitization, you should parse the URL and compare the structured hostname (or API group) using exact or well-scoped suffix checks instead of generic substring checks. For non-URL lists like apiGroups, you should ensure you are comparing whole elements, not substrings within them.
In this script, api_groups is a list of API group identifiers from a ClusterRole rule. The expression "dcops.microscaler.io" in api_groups is interpreted by CodeQL as a potentially unsafe substring test. However, in Python, in on a list already performs equality comparison on list elements, not substring containment. To make this intent explicit and robust against any accidental change of api_groups to a string in the future, we can normalize api_groups to a list of strings and then check for equality on each element. The safest, least intrusive fix is:
- Ensure
api_groupsis always treated as a list: if the JSON field is a single string, wrap it into a list. - Replace the direct membership test with an explicit loop or a
any(...)that compares each element for equality with"dcops.microscaler.io". This makes it impossible for"foo-dcops.microscaler.io-bar"to match ifapi_groupsever became a string or a list with such a value.
Concretely, in check_rbac in scripts/diagnose_missing_resources.py, at the point where api_groups is retrieved, we will:
- Fetch
apiGroupsas before. - If it is a string, convert it to a one-element list.
- Use
any(group == "dcops.microscaler.io" for group in api_groups)instead of"dcops.microscaler.io" in api_groups.
No new imports are required, and functionality remains the same when api_groups is the expected list of strings.
| @@ -68,17 +68,19 @@ | ||
| # Check if this kind has list permission | ||
| for rule in rules: | ||
| api_groups = rule.get("apiGroups", []) | ||
| if isinstance(api_groups, str): | ||
| api_groups = [api_groups] | ||
| resources = rule.get("resources", []) | ||
| verbs = rule.get("verbs", []) | ||
| if "dcops.microscaler.io" in api_groups: | ||
|
|
||
| if any(group == "dcops.microscaler.io" for group in api_groups): | ||
| # Convert kind to resource name (e.g., NetBoxDevice -> netboxdevices) | ||
| resource_name = kind.lower().replace("netbox", "netbox").replace("Box", "") | ||
| # More accurate: NetBoxDevice -> netboxdevices | ||
| if kind.startswith("NetBox"): | ||
| resource_name = kind[6:].lower() + "s" # Remove "NetBox" prefix, add 's' | ||
| resource_name = "netbox" + resource_name | ||
|
|
||
| # Check all possible resource name formats | ||
| possible_names = [ | ||
| resource_name, |
casibbald
force-pushed
the
kea-first-pass
branch
from
99205ec to
a87fda2
Compare
1 participant
No description provided.