msb-public/helm - helm - 马士兵教育代码仓库

Commit Graph

Author	SHA1	Message	Date
Adam Reese	657ce552cb	fix(): Validate metadata semver and printable characters ref: https://github.com/helm/helm/security/advisories/GHSA-c38g-469g-cmgx Skip invalid chart versions when reading the repository index file or when programmatically adding a chart version. * Adds semver validation and strips non-printable characters and normalizes spaces for string fields in Metadata.Validate() * Fixes a unit test that was pulling a remote repo. Now uses a local repo. * Fixes ignored error in repo update command Signed-off-by: Adam Reese <adam@reese.io>	4 years ago
Matt Butcher	fe2d7f7792	this rewrites a whole bunch of old repo URLs to the new repo URL (#8902 ) Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>	4 years ago
Matthew Fisher	f19acbdc94	fix: allow serverInfo field on index files A recent change merged into Helm fixes a number of security issues related to parsing malformed index files. Unfortunately, it also broke the ability for users to load index files from chartmuseum, which adds a "server info" field to add additional metadata. This commit adds that field so that index files from chartmuseum can be validated. Since Helm does not use this field for anything, the information is discarded and unused. Signed-off-by: Matthew Fisher <matt.fisher@microsoft.com>	4 years ago

Author

SHA1

Message

Date

Adam Reese

657ce552cb

fix(*): Validate metadata semver and printable characters

ref: https://github.com/helm/helm/security/advisories/GHSA-c38g-469g-cmgx

* Skip invalid chart versions when reading the repository index file or
  when programmatically adding a chart version.
* Adds semver validation and strips non-printable characters and
  normalizes spaces for string fields in Metadata.Validate()
* Fixes a unit test that was pulling a remote repo.  Now uses a local
  repo.
* Fixes ignored error in repo update command

Signed-off-by: Adam Reese <adam@reese.io>

Matt Butcher

fe2d7f7792

this rewrites a whole bunch of old repo URLs to the new repo URL (#8902 )

Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>

Matthew Fisher

f19acbdc94

fix: allow serverInfo field on index files

A recent change merged into Helm fixes a number of security issues related to parsing malformed index files. Unfortunately, it also broke the ability for users to load index files from chartmuseum, which adds a "server info" field to add additional metadata.

This commit adds that field so that index files from chartmuseum can be validated. Since Helm does not use this field for anything, the information is discarded and unused.

Signed-off-by: Matthew Fisher <matt.fisher@microsoft.com>

3 Commits (main)