Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Test case included for default and non-default
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Changed Fake Labeller Implementation
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Load the secret value from the RawValue field, if it is empty, use the
string value. Add unit tests for the creation handler.
Refactor secret parser tests.
Resolves#208
Signed-off-by: Lucas Roesler <roesler.lucas@gmail.com>
This patch fixes a vulnerability in the secrets API, however
it is important to stress that the user must be authenticated
as the admin user on the REST API before they can attempt this.
Reported by Appsecco via email. @lucasroesler, Appsecco and
myself believe this to be of low severity.
The fix prevents directory traversal characters from being
used in secret names. If a secret name such as:
../../root/.ssh/authorized_keys were to be used, an attacker
could remove the value and write their own.
Tested with unit tests and tests are now made to run
via the CI and a new Makefile target.
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
