syndesisio / syndesis

This project is archived. A flexible, customizable, open source platform that provides core integration capabilities as a service.
https://syndesis.io/
Apache License 2.0
597 stars 203 forks source link

Don't use user input in names, labels or annotations of k8s objects #3951

Open zregvart opened 5 years ago

zregvart commented 5 years ago

This is a...


[x] Feature request
[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report  
[ ] Documentation issue or request

Description

We should not use any user provided input in key-like properties of k8s objects. We currently rely on name sanitization which can yield non-unique names in several cases:

  1. two different names equal in the first 63 characters
  2. two different names equal in alphanumeric characters and placements, non equal in non-alphanumeric characters and placements (e.g. hello! and hello?)

We should instead either hash the user provided input or generate random values.

gashcrumb commented 5 years ago

+1! It also imposes arbitrary restrictions on what users can use for names that don't really make sense these days.

stale[bot] commented 5 years ago

This issue has been automatically marked as stale because it has not had any activity since 90 days. It will be closed if no further activity occurs within 7 days. Thank you for your contributions!

squakez commented 5 years ago

I can give a look on this. @zregvart do you have some property example where I can look at? right now I'm working on #6371 but I don't have enough context for this one. Thanks!

I understand it is related to this class implementation: https://github.com/syndesisio/syndesis/blob/16498025712e59d3cf4e9ac473f3575779234b1e/app/common/util/src/main/java/io/syndesis/common/util/Names.java#L52

squakez commented 4 years ago

Development done to partially accomplish the feature is available here: https://github.com/squakez/syndesis/tree/feature/3951_sanitized_collisions. Dropped in favor of a different redesign of the feature.