GO-2025-3648: Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev

accesscontrol

package

v0.8.1 Latest Latest Go to latest Published: Dec 18, 2025 License: Apache-2.0 Imports: 20 Imported by: 23

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/rancher/steve

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func SetAccessSetAttribute(schemas *types.APISchemas, accessSet *AccessSet)
type Access
- func (a Access) Grants(namespace, name string) bool
type AccessControl
- func NewAccessControl() *AccessControl
- func (a *AccessControl) CanDo(apiOp *types.APIRequest, resource, verb, namespace, name string) error
- func (a *AccessControl) CanWatch(apiOp *types.APIRequest, schema *types.APISchema) error
type AccessList
- func (a AccessList) Grants(namespace, name string) bool
type AccessListByVerb
- func GetAccessListMap(s *types.APISchema) AccessListByVerb
- func (a AccessListByVerb) All(verb string) bool
- func (a AccessListByVerb) AnyVerb(verb ...string) bool
- func (a AccessListByVerb) Granted(verb string) (result map[string]Resources)
- func (a AccessListByVerb) Grants(verb, namespace, name string) bool
type AccessSet
- func AccessSetFromAPIRequest(req *types.APIRequest) *AccessSet
- func (a AccessSet) AccessListFor(verb string, gr schema.GroupResource) (result AccessList)
- func (a *AccessSet) Add(verb string, gr schema.GroupResource, access Access)
- func (a *AccessSet) AddNonResourceURLs(verbs, urls []string)
- func (a AccessSet) Grants(verb string, gr schema.GroupResource, namespace, name string) bool
- func (a *AccessSet) GrantsNonResource(verb, url string) bool
- func (a *AccessSet) Merge(right *AccessSet)
- func (a *AccessSet) Namespaces() (result []string)
type AccessSetLookup
type AccessStore
- func NewAccessStore(_ context.Context, cacheResults bool, rbac v1.Interface) *AccessStore
- func (l *AccessStore) AccessFor(user user.Info) *AccessSet
- func (l *AccessStore) PurgeUserData(id string)
type Resources

Constants ¶

View Source

const (
	All = "*"
)

Variables ¶

This section is empty.

Functions ¶

func SetAccessSetAttribute ¶ added in v0.4.8

func SetAccessSetAttribute(schemas *types.APISchemas, accessSet *AccessSet)

SetAccessSetAttribute stores the provided accessSet using a predefined attribute

Types ¶

type Access ¶

type Access struct {
	Namespace    string
	ResourceName string
}

func (Access) Grants ¶

func (a Access) Grants(namespace, name string) bool

type AccessControl ¶

type AccessControl struct {
	apiserver.SchemaBasedAccess
}

func NewAccessControl ¶

func NewAccessControl() *AccessControl

func (*AccessControl) CanDo ¶

func (a *AccessControl) CanDo(apiOp *types.APIRequest, resource, verb, namespace, name string) error

func (*AccessControl) CanWatch ¶

func (a *AccessControl) CanWatch(apiOp *types.APIRequest, schema *types.APISchema) error

type AccessList ¶

type AccessList []Access

func (AccessList) Grants ¶

func (a AccessList) Grants(namespace, name string) bool

type AccessListByVerb ¶

type AccessListByVerb map[string]AccessList

func GetAccessListMap ¶

func GetAccessListMap(s *types.APISchema) AccessListByVerb

func (AccessListByVerb) All ¶

func (a AccessListByVerb) All(verb string) bool

func (AccessListByVerb) AnyVerb ¶

func (a AccessListByVerb) AnyVerb(verb ...string) bool

func (AccessListByVerb) Granted ¶

func (a AccessListByVerb) Granted(verb string) (result map[string]Resources)

func (AccessListByVerb) Grants ¶

func (a AccessListByVerb) Grants(verb, namespace, name string) bool

type AccessSet ¶

type AccessSet struct {
	ID string
	// contains filtered or unexported fields
}

func AccessSetFromAPIRequest ¶ added in v0.4.8

func AccessSetFromAPIRequest(req *types.APIRequest) *AccessSet

AccessSetFromAPIRequest retrieves an AccessSet from the APIRequest Schemas attributes, if defined. This attribute must have been previously set by using SetAccessSetAttribute

func (AccessSet) AccessListFor ¶

func (a AccessSet) AccessListFor(verb string, gr schema.GroupResource) (result AccessList)

func (*AccessSet) Add ¶

func (a *AccessSet) Add(verb string, gr schema.GroupResource, access Access)

func (*AccessSet) AddNonResourceURLs ¶ added in v0.5.0

func (a *AccessSet) AddNonResourceURLs(verbs, urls []string)

func (AccessSet) Grants ¶

func (a AccessSet) Grants(verb string, gr schema.GroupResource, namespace, name string) bool

func (*AccessSet) GrantsNonResource ¶ added in v0.5.0

func (a *AccessSet) GrantsNonResource(verb, url string) bool

func (*AccessSet) Merge ¶

func (a *AccessSet) Merge(right *AccessSet)

func (*AccessSet) Namespaces ¶

func (a *AccessSet) Namespaces() (result []string)

type AccessSetLookup ¶

type AccessSetLookup interface {
	AccessFor(user user.Info) *AccessSet
	PurgeUserData(id string)
}

type AccessStore ¶

type AccessStore struct {
	// contains filtered or unexported fields
}

func NewAccessStore ¶

func NewAccessStore(_ context.Context, cacheResults bool, rbac v1.Interface) *AccessStore

func (*AccessStore) AccessFor ¶

func (l *AccessStore) AccessFor(user user.Info) *AccessSet

func (*AccessStore) PurgeUserData ¶

func (l *AccessStore) PurgeUserData(id string)

type Resources ¶

type Resources struct {
	All   bool
	Names sets.String
}

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
fake Package fake is a generated GoMock package.	Package fake is a generated GoMock package.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL