Affected by GO-2022-0375 and 7 other vulnerabilities

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

GO-2024-3291: Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

GO-2025-3479: lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs

GO-2025-4090: lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs

simulator

package

v0.1.1-test Latest Latest Go to latest Published: Dec 26, 2021 License: Apache-2.0 Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/treeverse/lakefs

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func NewExternalRecordDownloader(region string) *externalRecordDownloader
func RegisterRecorder(next http.Handler, authService GatewayAuthService, region string, ...) http.Handler
func ShutdownRecorder()
type GatewayAuthService
type LazyOutput
- func NewLazyOutput(name string) *LazyOutput
- func (l *LazyOutput) Close() error
- func (l *LazyOutput) Write(d []byte) (int, error)
type PlayBackMockConf
type ResponseWriter
type StoredEvent

Constants ¶

View Source

const (
	RequestExtension        = ".request"
	ResponseExtension       = ".response"
	ResponseHeaderExtension = ".response_headers"
	RequestBodyExtension    = ".request_body"
	SimulationConfig        = "simulation_config.json"
	RecordingRoot           = "gateway/testdata/recordings"
)

View Source

const EtagExtension = "etag"

Variables ¶

This section is empty.

Functions ¶

func NewExternalRecordDownloader ¶

func NewExternalRecordDownloader(region string) *externalRecordDownloader

func RegisterRecorder ¶

func RegisterRecorder(next http.Handler, authService GatewayAuthService, region string, bareDomains []string) http.Handler

func ShutdownRecorder ¶

func ShutdownRecorder()

Types ¶

type GatewayAuthService ¶

type GatewayAuthService interface {
	GetCredentials(ctx context.Context, accessKey string) (*model.Credential, error)
	GetUserByID(ctx context.Context, userID int) (*model.User, error)
	Authorize(ctx context.Context, req *auth.AuthorizationRequest) (*auth.AuthorizationResponse, error)
}

a limited service interface for the gateway, used by simulation playback

type LazyOutput ¶

type LazyOutput struct {
	Name   string
	F      *os.File
	IsOpen bool
}

func NewLazyOutput ¶

func NewLazyOutput(name string) *LazyOutput

func (*LazyOutput) Close ¶

func (l *LazyOutput) Close() error

func (*LazyOutput) Write ¶

func (l *LazyOutput) Write(d []byte) (int, error)

type PlayBackMockConf ¶

type PlayBackMockConf struct {
	BareDomain      string `json:"bare_domain"`
	AccessKeyID     string `json:"access_key_id"`
	SecretAccessKey string `json:"access_secret_key"`
	UserID          int    `json:"user_id"`
	Region          string `json:"region"`
}

func (*PlayBackMockConf) Authorize ¶

func (m *PlayBackMockConf) Authorize(_ context.Context, req *auth.AuthorizationRequest) (*auth.AuthorizationResponse, error)

func (*PlayBackMockConf) GetCredentials ¶

func (m *PlayBackMockConf) GetCredentials(_ context.Context, accessKey string) (*model.Credential, error)

func (*PlayBackMockConf) GetUserByID ¶

func (m *PlayBackMockConf) GetUserByID(_ context.Context, userID int) (*model.User, error)

type ResponseWriter ¶

type ResponseWriter struct {
	OriginalWriter http.ResponseWriter
	ResponseLog    *LazyOutput
	StatusCode     int
	Headers        http.Header
	UploadIDRegexp *regexp.Regexp
	// contains filtered or unexported fields
}

func (w *ResponseWriter) Header() http.Header

func (*ResponseWriter) SaveHeaders ¶

func (w *ResponseWriter) SaveHeaders(fName string)

func (*ResponseWriter) Write ¶

func (w *ResponseWriter) Write(data []byte) (int, error)

func (*ResponseWriter) WriteHeader ¶

func (w *ResponseWriter) WriteHeader(statusCode int)

type StoredEvent ¶

type StoredEvent struct {
	Status   int    `json:"status"`
	UploadID string `json:"uploadId"`
	Request  string `json:"request"`
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL