GO-2026-4390: Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9

egress

package

v0.0.0-...-3253536 Latest Latest Go to latest Published: Oct 26, 2026 License: AGPL-3.0 Imports: 29 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/beam-cloud/beta9

Links

Open Source Insights

Documentation ¶

Overview ¶

Package egress enforces outbound policy and brokers sandbox credentials.

Index ¶

Constants
func TrustEnvironment() []string
type Dependencies
type Firewall
- func NewFirewall(config types.EgressConfig, addresses []string, deps Dependencies) *Firewall
type Policy

Constants ¶

View Source

const TrustBundlePath = "/etc/beam/ca-certificates.crt"

Variables ¶

This section is empty.

Functions ¶

func TrustEnvironment ¶

func TrustEnvironment() []string

Types ¶

type Dependencies ¶

type Dependencies struct {
	RootCertificates    []byte
	OriginalDestination func(net.Conn) (*net.TCPAddr, error)
	DialContext         func(context.Context, string, string) (net.Conn, error)
	RefreshBindings     func(context.Context, string, []types.SecretBinding) ([]types.SecretBinding, error)
}

type Firewall ¶

type Firewall struct {
	// contains filtered or unexported fields
}

func NewFirewall ¶

func NewFirewall(config types.EgressConfig, addresses []string, deps Dependencies) *Firewall

func (*Firewall) Config ¶

func (f *Firewall) Config() types.EgressConfig

func (*Firewall) Register ¶

func (f *Firewall) Register(id string, ips []string, policy Policy) error

Register revokes connections on policy changes while preserving the CA.

func (*Firewall) Start ¶

func (f *Firewall) Start(ctx context.Context) error

func (*Firewall) Stop ¶

func (f *Firewall) Stop()

func (*Firewall) TrustBundle ¶

func (f *Firewall) TrustBundle(id, directory string) (string, error)

TrustBundle writes public certificates only; the CA key never leaves memory.

func (*Firewall) Unregister ¶

func (f *Firewall) Unregister(id string)

type Policy ¶

type Policy struct {
	Open         bool
	BindingsOnly bool
	AllowList    []string
	Bindings     []types.SecretBinding
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL