novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

mounts: name a malformed entry of sources by its position, never by its name
mesh/merge-gate pass: builds mounts → shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
Details
mesh/delivery delivered
Details

Browse Source 
A password holding '=' and a space or comma splits the entry, and the tail
read as name=... was said as "the source <tail>", carrying part of the
secret into the health answer and the operator's conditions (review of
mesh-catalog#190, issue 386).
This commit is contained in:
jochen
2026-10-10 21:38:17 +02:00
parent 58ec352b8c
commit a12b5908aa
3 changed files with 24 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/mounts/cmd/mounts/write_test.go
+7 -2
View File
@@ -490,10 +490,15 @@ func TestAnSMBSourcesUserIsInItsEntryAndAPasswordThereIsRefusedUnsaid(t *testing
"e=SMB://root:" + secret + "@nas/Media@/mnt/e",
"e=cifs://root:" + secret + "@nas/Media@/mnt/e",
"SECRET" + "PW=smb://nas/Media@/mnt/e",
// A password holding '=' and a space, or '=' and a comma: the tail reads like name=… and is still not said.
"e=smb://root:sec RETPW=x@nas/Media@/mnt/e",
"e=smb://root:sec,RETPW=x@nas/Media@/mnt/e",
"e=smb://root:SEC RETPW=smb://nas/Media@/mnt/e",
} {
_, problems := ParseSources(v)
said := strings.Join(problems, " ")
if len(problems) == 0 || strings.Contains(said, "RETPW") || strings.Contains(said, "SEC") {
if len(problems) == 0 || strings.Contains(strings.ToUpper(said), "RETPW") || strings.Contains(said, "SEC") ||
strings.Contains(said, "sec") && !strings.Contains(said, "secret smb-password") {
t.Errorf("%q says %q", strings.ReplaceAll(v, "RETPW", "<pw>"), said)
}
// And nothing of it reaches the status or the health answer.
@@ -502,7 +507,7 @@ func TestAnSMBSourcesUserIsInItsEntryAndAPasswordThereIsRefusedUnsaid(t *testing
now := time.Now()
f.applier(now).Look(context.Background())
raw, _ := json.Marshal(f.machine().Health(now))
if strings.Contains(string(raw), "RETPW") || strings.Contains(f.everything("mounts.conf"), "RETPW") {
if strings.Contains(strings.ToUpper(string(raw)), "RETPW") || strings.Contains(strings.ToUpper(f.everything("mounts.conf")), "RETPW") {
t.Errorf("%q leaked into the status or the health: %s", strings.ReplaceAll(v, "RETPW", "<pw>"), raw)
}
}