First commit for ControllerMesh -- just for test #2

FillZpp · 2021-02-03T03:27:53Z

Ⅰ. Describe what this PR does

First commit for ControllerMesh -- just for test

Ⅱ. Does this pull request fix one issue?

Ⅲ. List the added test cases (unit test/integration test) if any, please explain if no tests are needed.

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

codecov-io · 2021-02-03T03:55:17Z

Codecov Report

Merging #2 (a8b66ce) into master (2e133cb) will decrease coverage by 0.69%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##           master       #2      +/-   ##
==========================================
- Coverage   47.74%   47.04%   -0.70%     
==========================================
  Files          82       82              
  Lines        7570     7682     +112     
==========================================
  Hits         3614     3614              
- Misses       3379     3491     +112     
  Partials      577      577

Flag	Coverage Δ
unittests	`47.04% <0.00%> (-0.70%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/util/client.go	`0.00% <0.00%> (ø)`
.../webhook/pod/mutating/pod_create_update_handler.go	`0.00% <0.00%> (ø)`
...ebhook/pod/mutating/virtualoperator_pod_handler.go	`0.00% <0.00%> (ø)`
pkg/controller/cloneset/cloneset_controller.go	`57.69% <0.00%> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2e133cb...a8b66ce. Read the comment docs.

Signed-off-by: Siyu Wang <[email protected]>

sonatype-lift · 2021-06-16T09:07:27Z

go.mod

 	github.com/go-bindata/go-bindata v3.1.2+incompatible // indirect
 	github.com/go-openapi/spec v0.19.2
 	github.com/gogo/googleapis v1.4.0 // indirect
+	github.com/gogo/protobuf v1.3.1


Critical OSS Vulnerability:

pkg:golang/github.com/gogo/[email protected]

1 Critical, 0 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a direct dependency

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:28Z

vendor/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/grpc_service.go

+				klog.Errorf("failed to create connection to unix socket: %s, error: %v", addr, err)
+			}
+			return c, err
+		}))


opt.semgrep.go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection: Found an insecure gRPC connection. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:29Z

pkg/grpcregistry/registry.go

+	var opts []grpc.ServerOption
+	// Set max message size in bytes is 64MB
+	opts = append(opts, grpc.MaxRecvMsgSize(1024*1024*64))
+	grpcServer := grpc.NewServer(opts...)


opt.semgrep.go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection: Found an insecure gRPC connection. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:31Z

vendor/github.com/gogo/protobuf/plugin/equal/equal.go

+					p.P(`if this.`, fieldname, `[i] != that1.`, fieldname, `[i] {`)
+				} else {
+					p.P(`if this.`, fieldname, `[i] != that1.`, fieldname, `[i] {`)
+				}


opt.semgrep.go.lang.maintainability.useless-ifelse.useless-if-body: Detected identical if-statement bodies. Is this intentional?

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:32Z

vendor/github.com/gogo/protobuf/plugin/gostring/gostring.go

+					} else {
+						p.P(`s = append(s, "`, fieldname, `: " + `, fmtPkg.Use(), `.Sprintf("%#v", this.`, fieldname, `) + ",\n")`)
+					}
+				}


opt.semgrep.go.lang.maintainability.useless-ifelse.useless-if-body: Detected identical if-statement bodies. Is this intentional?

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:33Z

vendor/github.com/gogo/protobuf/plugin/size/size.go

+			p.P(`n+=`, strconv.Itoa(key+1))
+		} else {
+			p.P(`n+=`, strconv.Itoa(key+1))
+		}


opt.semgrep.go.lang.maintainability.useless-ifelse.useless-if-body: Detected identical if-statement bodies. Is this intentional?

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:35Z

pkg/ctrlmesh/util/spec_hash.go

+}
+
+func getMD5Hash(text string) string {
+	hash := md5.Sum([]byte(text))


opt.semgrep.go.lang.security.audit.crypto.bad_imports.insecure-module-used: Insecure module used.
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:36Z

vendor/github.com/pborman/uuid/hash.go

+//
+//  NewHash(sha1.New(), space, data, 5)
+func NewSHA1(space UUID, data []byte) UUID {
+	return NewHash(sha1.New(), space, data, 5)


opt.semgrep.go.lang.security.audit.crypto.bad_imports.insecure-module-used: Insecure module used.
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:37Z

vendor/golang.org/x/net/websocket/hybi.go

+// getNonceAccept computes the base64-encoded SHA-1 of the concatenation of
+// the nonce ("Sec-WebSocket-Key" value) with the websocket GUID string.
+func getNonceAccept(nonce []byte) (expected []byte, err error) {
+	h := sha1.New()


opt.semgrep.go.lang.security.audit.crypto.bad_imports.insecure-module-used: Insecure module used.
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:38Z

pkg/ctrlmesh/util/spec_hash.go

+}
+
+func getMD5Hash(text string) string {
+	hash := md5.Sum([]byte(text))


opt.semgrep.go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not
collision resistant and is therefore not suitable as a cryptographic
signature. Use SHA256 or SHA3 instead.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:39Z

vendor/github.com/pborman/uuid/hash.go

+//
+//  NewHash(md5.New(), space, data, 3)
+func NewMD5(space UUID, data []byte) UUID {
+	return NewHash(md5.New(), space, data, 3)


opt.semgrep.go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not
collision resistant and is therefore not suitable as a cryptographic
signature. Use SHA256 or SHA3 instead.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:40Z

vendor/github.com/pborman/uuid/hash.go

+//
+//  NewHash(sha1.New(), space, data, 5)
+func NewSHA1(space UUID, data []byte) UUID {
+	return NewHash(sha1.New(), space, data, 5)


opt.semgrep.go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic
signature. Use SHA256 or SHA3 instead.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:41Z

vendor/golang.org/x/net/websocket/hybi.go

+// getNonceAccept computes the base64-encoded SHA-1 of the concatenation of
+// the nonce ("Sec-WebSocket-Key" value) with the websocket GUID string.
+func getNonceAccept(nonce []byte) (expected []byte, err error) {
+	h := sha1.New()


opt.semgrep.go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not
collision resistant and is therefore not suitable as a cryptographic
signature. Use SHA256 or SHA3 instead.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:42Z

vendor/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/writers.go

+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	w.Write(output)


opt.semgrep.no-direct-write-to-responsewriter: Detected directly writing or similar in http.ResponseWriter.write().
This bypasses HTML escaping that prevents cross-site scripting
vulnerabilities. Instead, use the 'html/template' package
and render data using template.Execute().

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:44Z

vendor/k8s.io/apiserver/pkg/server/routes/flags.go

+func writePlainText(statusCode int, text string, w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "text/plain")
+	w.WriteHeader(statusCode)
+	fmt.Fprintln(w, text)


opt.semgrep.no-fprintf-to-responsewriter: Detected Fprintf or similar writing to http.ResponseWriter.
This bypasses HTML escaping that prevents cross-site scripting
vulnerabilities. Instead, use the 'html/template' package
to render data to users.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:45Z

pkg/ctrlmesh/proxy/grpcclient/grpc_client.go

+			continue
+		}
+
+		addr := fmt.Sprintf("%s:%d", leader.PodIP, metaInfo.Status.Ports.GrpcLeaderElectionPort)


opt.semgrep.sprintf-host-port: Use net.JoinHostPort instead of fmt.Sprintf($XX, addr). When using IPv6, JoinHostPort continues to operate properly.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:46Z

pkg/ctrlmesh/proxy/grpcclient/grpc_client.go

+			continue
+		}
+
+		addr := fmt.Sprintf("%s:%d", leader.PodIP, metaInfo.Status.Ports.GrpcLeaderElectionPort)


opt.semgrep.sprintf-host-port: Use net.JoinHostPort instead of fmt.Sprintf(metaInfo.Status.Ports.GrpcLeaderElectionPort, leader.PodIP). When using IPv6, JoinHostPort continues to operate properly.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:47Z

pkg/ctrlmesh/proxy/webhook/webhook_handler.go

+		tc.cache = make(map[string]http.RoundTripper, 10)
+	}
+	host := hosts[0]
+	redirectHost := fmt.Sprintf("%s:%d", host, tc.webhookPort)


opt.semgrep.sprintf-host-port: Use net.JoinHostPort instead of fmt.Sprintf($XX, redirectHost). When using IPv6, JoinHostPort continues to operate properly.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:48Z

pkg/ctrlmesh/proxy/webhook/webhook_handler.go

+		tc.cache = make(map[string]http.RoundTripper, 10)
+	}
+	host := hosts[0]
+	redirectHost := fmt.Sprintf("%s:%d", host, tc.webhookPort)


opt.semgrep.sprintf-host-port: Use net.JoinHostPort instead of fmt.Sprintf(tc.webhookPort, host). When using IPv6, JoinHostPort continues to operate properly.

(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:50Z

cmd/ctrlmesh-proxy/main.go

+			klog.Infof("Webhook proxy stopped")
+		}
+	}
+	select {


S1000: should use a simple channel send/receive instead of select with a single case
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:51Z

pkg/ctrlmesh/proxy/grpcclient/grpc_client.go

+func (c *GrpcClient) connect(stopChan <-chan struct{}, initChan chan struct{}) {
+	parentCtx, parentCancel := context.WithCancel(context.Background())
+	go func() {
+		select {


S1000: should use a simple channel send/receive instead of select with a single case
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:52Z

pkg/ctrlmesh/proxy/apiserver/router/router.go

+	})
+
+	listObj.Object["items"] = newItems
+	return


S1023: redundant return statement
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:53Z

pkg/ctrlmesh/util/reverseproxy.go

+	go spc.copyToBackend(errc)
+	go spc.copyFromBackend(errc)
+	<-errc
+	return


S1023: redundant return statement
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:54Z

pkg/ctrlmesh/util/reverseproxy.go

+	}
+
+	ctx := req.Context()
+	if cn, ok := rw.(http.CloseNotifier); ok {


SA1019: http.CloseNotifier has been deprecated since Go 1.11 and an alternative has been available since Go 1.7: the CloseNotifier interface predates Go's context package. New code should use Request.Context instead.
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:55Z

pkg/ctrlmesh/proxy/apiserver/router/router.go

+		t.remaining = body[n:]
+		return n, nil
+	}
+	p = append(p[0:0], body...)


SA4006: this value of p is never used
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:56Z

pkg/ctrlmesh/proxy/apiserver/router/router.go

+		t.remaining = body[n:]
+		return n, nil
+	}
+	p = append(p[0:0], body...)


SA4010: this result of append is never used, except maybe in other appends
(at-me in a reply with help or ignore)

sonatype-lift · 2021-06-16T09:07:57Z

pkg/ctrlmesh/util/reverseproxy.go

+
+	conn, brw, err := hj.Hijack()
+	if err != nil {
+		p.getErrorHandler()(rw, req, fmt.Errorf("Hijack failed on protocol switch: %v", err))


ST1005: error strings should not be capitalized
(at-me in a reply with help or ignore)

FillZpp force-pushed the controllermesh-first-commit branch from 0a905f3 to 4127d3c Compare February 3, 2021 03:45

FillZpp force-pushed the controllermesh-first-commit branch 6 times, most recently from 570b82e to 3865d80 Compare February 8, 2021 09:07

FillZpp force-pushed the controllermesh-first-commit branch 3 times, most recently from 977e0d6 to 5b09248 Compare March 4, 2021 06:43

FillZpp force-pushed the controllermesh-first-commit branch from 5b09248 to c310ef2 Compare March 5, 2021 10:09

FillZpp force-pushed the controllermesh-first-commit branch 2 times, most recently from 4eaad0e to 48e5bff Compare March 15, 2021 08:40

FillZpp force-pushed the controllermesh-first-commit branch 4 times, most recently from df299a0 to 07f8bb4 Compare April 2, 2021 04:55

FillZpp force-pushed the controllermesh-first-commit branch from 07f8bb4 to f668804 Compare June 16, 2021 08:49

First commit for ControllerMesh

238600d

Signed-off-by: Siyu Wang <[email protected]>

FillZpp force-pushed the controllermesh-first-commit branch from f668804 to 238600d Compare June 16, 2021 08:49

sonatype-lift bot reviewed Jun 16, 2021

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

First commit for ControllerMesh -- just for test #2

First commit for ControllerMesh -- just for test #2

FillZpp commented Feb 3, 2021

codecov-io commented Feb 3, 2021 •

edited

Loading

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

sonatype-lift bot Jun 16, 2021

First commit for ControllerMesh -- just for test #2

Are you sure you want to change the base?

First commit for ControllerMesh -- just for test #2

Conversation

FillZpp commented Feb 3, 2021

Ⅰ. Describe what this PR does

Ⅱ. Does this pull request fix one issue?

Ⅲ. List the added test cases (unit test/integration test) if any, please explain if no tests are needed.

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

codecov-io commented Feb 3, 2021 • edited Loading

Codecov Report

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

pkg:golang/github.com/gogo/[email protected]

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

sonatype-lift bot Jun 16, 2021

Choose a reason for hiding this comment

codecov-io commented Feb 3, 2021 •

edited

Loading