slack: only enforce token prefixes on literal values - #4656
Open
hsdfat wants to merge 1 commit into
Open
Conversation
The bot_token and app_token fields are linted with a has_prefix check, so
a config that sources the token from a secret, for example
slack_post:
bot_token: "${secrets.SLACK_APP_BOT_TOKEN}"
is rejected with "field must start with xoxb-". Secret and environment
variable references are resolved when a config is read, which is not
necessarily before it is linted: a linter without access to the value
sees either the reference verbatim or the empty string it falls back to,
neither of which can be checked against the prefix.
Skip the check for those two cases and keep enforcing it everywhere else,
so a literal token of the wrong type is still reported.
Fixes redpanda-data#4511
|
|
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4511.
LintRule(has_prefix("xoxb-"))runs against the raw config value, before interpolation — so a validbot_token: "${secrets.SLACK_APP_BOT_TOKEN}"was rejected at lint time.Adds a
tokenLintRule(prefix)helper that skips the prefix check when the value is empty or starts with${, and keeps enforcing it for literals so a malformed literal token is still caught.The issue reports
output_post.go, but the same rule is duplicated ininput.go(xapp- and xoxb-),input_users.go,output_reaction.goandprocessor_thread.go— all five now go through the helper.A missing required
bot_tokenstill produces the separate "field is required" lint, so this doesn't hide a misconfiguration.Adds
lint_test.gocovering all five components: unresolved${secrets...}, an env lookup resolving to empty, valid literal, invalid literal, and a secret whose value starts with the prefix.