search

alerta / alerta-contrib

Contributed integrations, plugins and custom webhooks
http://alerta.io
MIT License
119 stars 170 forks source link

Reject plugin allow not-allowed environment #375

Closed danielelopez1 closed 1 year ago

danielelopez1 commented 2 years ago

Issue Summary when i try to post an alert with a not-allowed enviroment, it open the alert with that enviroment if it have the same root as an allowed enviroment. i.e. if i allow "Production", any Production* enviroments will be allowed: "ProductionA" or "ProductionABC" etc. If I post "production" or "productionA" "ABCProduction" etc. it is not allowed (as expected), cause they are not in my "ALLOWED_ENVIRONMENTS" config and haven't the same root as "Production" (with the capital P). I think is just a matching matter.

Environment

DATABASE_URL = 'postgresql://user:password@mydb.com/alerta' DATABASE_NAME = 'alerta' BASE_URL='/api' PLUGINS = [ "blackout", "normalise", "reject" ]

#########AUTHENTICATION########### AUTH_REQUIRED = True SECRET_KEY = '1UgWRmd!XGcExUU*dGIM#4kwsN^oR77' ADMIN_USERS = ['user1', 'user2'] ADMIN_ROLES = ['admin'] USER_DEFAULT_SCOPES = ['read:alerts','read:customers'] CUSTOMER_VIEWS = True AUTH_PROVIDER = 'basic' SIGNUP_ENABLED = False GUEST_DEFAULT_SCOPES = ['read:alerts']

ALLOWED_ENVIRONMENTS = ['Production', 'Pre-Production', 'Disaster Recovery', 'Development', 'Test', 'UNKNOWN']

To Reproduce Steps to reproduce the behavior:

  1. Enable reject plugin
  2. Set ALLOWED_ENVIRONMENTS configuration with "Production" environment
  3. post an alert with ProductionA or ProductionABC enviroment

Expected behavior All not-allowed enviroment had to be rejected

Additional context I'm usign latest docker image: Alerta 8.5.0

satterly commented 2 years ago

You're right it's a regex match not a simple equality check.

https://github.com/alerta/alerta/blob/38599d814f5c56a8621b9c58e418b1f0b23b90e4/alerta/plugins/reject.py#L31

Either anchor your regex with a $ at the end or modify the plugin to use ==.

danielelopez1 commented 2 years ago

Thank you for your answer. Is possible for future releases to improve the plugin just changing regex.match with regex.fullmatch? i think it can be a nice and useful improvement. Without changing the plugin logic or scope. just a suggestion.

ClifHouck commented 1 year ago

I'm going to take a stab at this.