GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

cel

package

v0.14.1 Latest Latest Go to latest Published: Aug 25, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

View Source

const (
	ObjectVariable      = "object"
	MaxExpressionLength = 4096
)

This section is empty.

This section is empty.

type CompiledExpression struct {
	// contains filtered or unexported fields
}

func (c *CompiledExpression) EvaluateBoolean(
	ctx context.Context,
	object unstructured.Unstructured,
) (bool, error)

func (c *CompiledExpression) EvaluateQuantity(
	ctx context.Context,
	object unstructured.Unstructured,
) (resource.Quantity, error)

func (c *CompiledExpression) Expression() string

type Compiler struct {
	// contains filtered or unexported fields
}

func NewCompiler() (*Compiler, error)

func (c *Compiler) CompileBoolean(expression string, mode environment.Type) (*CompiledExpression, error)

func (c *Compiler) CompileQuantity(expression string, mode environment.Type) (*CompiledExpression, error)

type ResultType string

const (
	ResultTypeBoolean  ResultType = "boolean"
	ResultTypeQuantity ResultType = "quantity"
)