kapitan 0.35.2.dev34__tar.gz → 0.35.2.dev36__tar.gz

{kapitan-0.35.2.dev34 → kapitan-0.35.2.dev36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kapitan
-Version: 0.35.2.dev34
+Version: 0.35.2.dev36
 Summary: Generic templated configuration management for Kubernetes, Terraform and other things
 Project-URL: Homepage, https://kapitan.dev
 Project-URL: Repository, https://github.com/kapicorp/kapitan

{kapitan-0.35.2.dev34 → kapitan-0.35.2.dev36}/kapitan/refs/vault_resources.py

@@ -50,6 +50,11 @@ class VaultClient(hvac.Client):
         self.env["token"] = token
 
     def read_token_from_file(self, token_file):
+        if os.path.islink(token_file):
+            raise VaultError(
+                f"Token file {token_file} is a symbolic link and will not be read"
+            )
+
         try:
             with open(token_file) as fp:
                 token = fp.read()

{kapitan-0.35.2.dev34 → kapitan-0.35.2.dev36}/kapitan/utils.py

@@ -50,6 +50,16 @@ try:
 except ImportError:
     from yaml import SafeLoader as YamlLoader
 
+# PyYAML SafeLoader lacks constructor for 'tag:yaml.org,2002:value' (bare '=').
+# Some charts emit this, causing a ConstructorError. Treat it as a scalar string.
+# https://github.com/yaml/pyyaml/issues/89
+# https://github.com/kapicorp/kapitan/issues/1415
+for _YamlLoader in {YamlLoader, yaml.SafeLoader}:
+    _YamlLoader.add_constructor(
+        "tag:yaml.org,2002:value",
+        lambda loader, node: loader.construct_scalar(node),
+    )
+
 
 def fatal_error(message):
     "Logs error message, sys.exit(1)"

{kapitan-0.35.2.dev34 → kapitan-0.35.2.dev36}/tests/test_utils.py

@@ -14,8 +14,11 @@ import stat
 import tempfile
 import unittest
 
+import yaml
+
 from kapitan.utils import (
     SafeCopyError,
+    YamlLoader,
     compare_versions,
     copy_tree,
     deep_get,
@@ -121,6 +124,25 @@ class CopyTreeTest(unittest.TestCase):
         shutil.rmtree(self.temp_dir)
 
 
+class YamlLoaderValueTagTest(unittest.TestCase):
+    """Regression test for PyYAML ConstructorError on bare '=' (value tag).
+
+    https://github.com/kapicorp/kapitan/issues/1415
+    """
+
+    def test_bare_equal_sign(self):
+        result = yaml.load("=", Loader=YamlLoader)
+        self.assertEqual(result, "=")
+
+    def test_list_with_equal_sign(self):
+        result = yaml.load("- =", Loader=YamlLoader)
+        self.assertEqual(result, ["="])
+
+    def test_nested_equal_sign(self):
+        result = yaml.load("items:\n  - =", Loader=YamlLoader)
+        self.assertEqual(result, {"items": ["="]})
+
+
 class PruneEmptyTest(unittest.TestCase):
     """Test prune_empty removes empty collections recursively."""
 

kapitan-0.35.2.dev36/tests/test_vault_resources_security.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+
+# Copyright 2019 The Kapitan Authors
+# SPDX-FileCopyrightText: 2020 The Kapitan Authors <kapitan-admins@googlegroups.com>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""Security-focused unit tests for vault_resources without requiring a Vault server."""
+
+import os
+import tempfile
+import unittest
+
+from kapitan.refs.vault_resources import VaultClient, VaultError
+
+
+class VaultClientSecurityTest(unittest.TestCase):
+    """Test VaultClient security behaviours independent of a running Vault server."""
+
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+
+    def tearDown(self):
+        import shutil
+
+        shutil.rmtree(self.tmpdir, ignore_errors=True)
+
+    def test_read_token_from_file_rejects_symlink(self):
+        real_file = os.path.join(self.tmpdir, "real_token")
+        symlink = os.path.join(self.tmpdir, ".vault-token")
+
+        with open(real_file, "w") as fp:
+            fp.write("s3cr3t")
+
+        os.symlink(real_file, symlink)
+
+        client = VaultClient.__new__(VaultClient)
+        with self.assertRaises(VaultError) as ctx:
+            client.read_token_from_file(symlink)
+        self.assertIn("symbolic link", str(ctx.exception))
+
+    def test_read_token_from_file_accepts_regular_file(self):
+        token_file = os.path.join(self.tmpdir, ".vault-token")
+
+        with open(token_file, "w") as fp:
+            fp.write("s3cr3t")
+
+        client = VaultClient.__new__(VaultClient)
+        token = client.read_token_from_file(token_file)
+        self.assertEqual(token, "s3cr3t")
+
+    def test_read_token_from_file_rejects_empty_file(self):
+        token_file = os.path.join(self.tmpdir, ".vault-token")
+
+        with open(token_file, "w") as fp:
+            pass
+
+        client = VaultClient.__new__(VaultClient)
+        with self.assertRaises(VaultError) as ctx:
+            client.read_token_from_file(token_file)
+        self.assertIn("empty", str(ctx.exception))