Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(spyglass/lenses) allow configuration sandbox permissions #296

Merged
merged 2 commits into from
Feb 1, 2025
+54 −12
Merged

(spyglass/lenses) allow configuration sandbox permissions #296

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2377f0e
(spyglass/lenses) allow configuration sandbox permissions
norrs Oct 10, 2024
44d0098
(spyglass/lenses) test: specific empty permission configuration
norrs Jan 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cmd/checkconfig/testdata/combined.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ deck:
- (FAIL|Failure \[)\b
- panic\b
- ^E\d{4} \d\d:\d\d:\d\d\.\d\d\d]
iframe_sandbox_permissions:
- allow-scripts
- allow-popups
- allow-popups-to-escape-sandbox
Comment on lines +26 to +29
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated this as it looked like a sane idea to do if this is supposed to demostrate a full configuration file example.

required_files:
- build-log.txt
- lens:
Expand Down
2 changes: 1 addition & 1 deletion cmd/deck/template/spyglass.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
<div class="mdl-card__title lens-title"><h3 class="mdl-card__title-text">{{$config.Title}}</h3></div>
<div id="{{$config.Name}}-view-container" class="lens-view-content mdl-card__supporting-text">
<img src="/static/kubernetes-wheel.svg?v={{deckVersion}}" alt="loading spinner" class="loading-spinner is-active lens-card-loading" id="{{$config.Name}}-loading">
<iframe class="lens-container" style="visibility: hidden;" id="iframe-{{$index}}" sandbox="allow-scripts allow-top-navigation allow-popups allow-same-origin" data-lens-index="{{$index}}" data-lens-name="{{$config.Name}}"{{if $config.HideTitle}} data-hide-title="true"{{end}}></iframe>
<iframe class="lens-container" style="visibility: hidden;" id="iframe-{{$index}}" sandbox="{{$config.IframeSandboxPermissions}}" data-lens-index="{{$index}}" data-lens-name="{{$config.Name}}"{{if $config.HideTitle}} data-hide-title="true"{{end}}></iframe>
</div>
</div>
{{end}}
Expand Down
41 changes: 31 additions & 10 deletions pkg/spyglass/lenses/buildlog/lens.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,11 @@ const (
var defaultHighlightLineLengthMax = 10000 // Default maximum length of a line worth highlighting

type config struct {
HighlightRegexes []string `json:"highlight_regexes"`
HideRawLog bool `json:"hide_raw_log,omitempty"`
Highlighter *highlightConfig `json:"highlighter,omitempty"`
HighlightLengthMax *int `json:"highlight_line_length_max,omitempty"`
HighlightRegexes []string `json:"highlight_regexes"`
HideRawLog bool `json:"hide_raw_log,omitempty"`
Highlighter *highlightConfig `json:"highlighter,omitempty"`
HighlightLengthMax *int `json:"highlight_line_length_max,omitempty"`
IframeSandboxPermissions []string `json:"iframe_sandbox_permissions,omitempty"`
}

type highlightConfig struct {
Expand All @@ -68,10 +69,11 @@ type highlightConfig struct {
}

type parsedConfig struct {
highlightRegex *regexp.Regexp
showRawLog bool
highlighter *highlightConfig
highlightLengthMax int
highlightRegex *regexp.Regexp
showRawLog bool
highlighter *highlightConfig
highlightLengthMax int
IframeSandboxPermissions string
}

var _ api.Lens = Lens{}
Expand All @@ -97,6 +99,17 @@ func (lens Lens) Header(artifacts []api.Artifact, resourceDir string, config jso
// It is only used if highlight_regexes is not specified in the lens config.
var defaultErrRE = regexp.MustCompile(`timed out|ERROR:|(FAIL|Failure \[)\b|panic\b|^E\d{4} \d\d:\d\d:\d\d\.\d\d\d]`)

// defaultSandboxPermissions is the default value for iframe_sandbox_permissions lense config if it is not specified.
var defaultSandboxPermissions = strings.Join(
[]string{
"allow-scripts",
"allow-top-navigation",
"allow-popups",
"allow-same-origin",
},
" ",
)
Comment on lines +103 to +111
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is defaultSandboxPermissions for the parsedConfig, tho I personally like to work with arrays instead of strings with foo bar zar.

Not sure if you prefer this or the allow-scripts allow-top-navigation allow-popups allow-same-origin instead.

Please let me know, I'll update if you want to change it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion is to do another PR after this to adjust the defaults to not combine allow-same-origin together with allow-scripts, but I suppose this needs to be communicated to the users of the prow installation, so they are aware of the ability to configure this pr lense.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arrays sound reasonable to me, and I think it's easier to catch differences.

And that sounds good to me.


func init() {
lenses.RegisterLens(Lens{})
}
Expand Down Expand Up @@ -170,8 +183,9 @@ type buildLogsView struct {

func getConfig(rawConfig json.RawMessage) parsedConfig {
conf := parsedConfig{
highlightRegex: defaultErrRE,
showRawLog: true,
highlightRegex: defaultErrRE,
showRawLog: true,
IframeSandboxPermissions: defaultSandboxPermissions,
}

// No config at all is fine.
Expand All @@ -189,6 +203,13 @@ func getConfig(rawConfig json.RawMessage) parsedConfig {
conf.highlighter = nil
}
conf.showRawLog = !c.HideRawLog

if c.IframeSandboxPermissions == nil {
conf.IframeSandboxPermissions = defaultSandboxPermissions
} else {
conf.IframeSandboxPermissions = strings.Join(c.IframeSandboxPermissions, " ")
}

if len(c.HighlightRegexes) == 0 {
return conf
}
Expand Down
11 changes: 10 additions & 1 deletion pkg/spyglass/lenses/buildlog/lens_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ import (

func TestGetConfig(t *testing.T) {
def := parsedConfig{
showRawLog: true,
showRawLog: true,
IframeSandboxPermissions: defaultSandboxPermissions,
}
cases := []struct {
name string
Expand All @@ -61,6 +62,14 @@ func TestGetConfig(t *testing.T) {
}
return d
}(),
}, {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Add test case verifying what the iframe permissions are if none are specified.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added test @michelle192837 , good nit 👍

name: "configure iframe sandbox permissions",
raw: `{"iframe_sandbox_permissions": ["allow-scripts", "allow-downloads"]}`,
want: func() parsedConfig {
d := def
d.IframeSandboxPermissions = "allow-scripts allow-downloads"
return d
}(),
},
}

Expand Down