mirror of
https://github.com/labring/sealos.git
synced 2026-08-30 17:58:09 +08:00
fix: the rest of semgrep scan issues (#1886)
Signed-off-by: Mercurio <signormercurio@gmail.com>
This commit is contained in:
Mercurio
@@ -2,8 +2,7 @@ FROM gcr.io/distroless/static:nonroot
|
||||
ARG TARGETARCH
|
||||
|
||||
WORKDIR /
|
||||
RUN useradd -u 1337 terminal
|
||||
USER terminal
|
||||
USER 65532:65532
|
||||
|
||||
COPY bin/controller-terminal-$TARGETARCH /manager
|
||||
ENTRYPOINT ["/manager"]
|
||||
|
||||
@@ -406,6 +406,7 @@ spec:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
|
||||
@@ -987,6 +987,7 @@ spec:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
|
||||
@@ -8,4 +8,5 @@ RUN --mount=target=/build tar xf /build/dist/sealos_*_$(echo ${TARGETPLATFORM} |
|
||||
|
||||
# nosemgrep: dockerfile.security.missing-user.missing-user
|
||||
ENTRYPOINT ["/usr/bin/lvscare"]
|
||||
# nosemgrep: dockerfile.security.missing-user.missing-user
|
||||
CMD ["--help"]
|
||||
|
||||
@@ -7,4 +7,5 @@ RUN --mount=target=/build tar xf /build/dist/sealos_*_$(echo ${TARGETPLATFORM} |
|
||||
|
||||
# nosemgrep: dockerfile.security.missing-user.missing-user
|
||||
ENTRYPOINT ["/usr/bin/sealos"]
|
||||
# nosemgrep: dockerfile.security.missing-user.missing-user
|
||||
CMD ["--help"]
|
||||
|
||||
@@ -4,5 +4,4 @@ ARG TARGETARCH
|
||||
WORKDIR /usr/bin/
|
||||
|
||||
COPY --chmod=0755 /bin/sealos-$TARGETARCH/sealos .
|
||||
# nosemgrep: dockerfile.security.missing-user.missing-user
|
||||
ENTRYPOINT ["/usr/bin/sealos"]
|
||||
|
||||
@@ -34,8 +34,8 @@ func New(registryURL, username, password string, logFunc LogfCallback) (*Registr
|
||||
* SSL certificate verification.
|
||||
*/
|
||||
func NewInsecure(registryURL, username, password string, logFunc LogfCallback) (*Registry, error) {
|
||||
// nosemgrep
|
||||
transport := &http.Transport{
|
||||
// nosemgrep
|
||||
TLSClientConfig: &tls.Config{
|
||||
// TODO: Why?
|
||||
InsecureSkipVerify: true, //nolint:gosec
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEA3LTJR5Q8qHyyd7YHSO+Ao7cKiDixsnIAmF2JfdndfAudUeTW
|
||||
P/xWLcFMVYWOuhlfuIStueuBC5nPmk5KKlTkNCjXys1SpnZnGDwdEcWF0irGVgnb
|
||||
67yHkAUghN2i0vaWjQHgWNYhdW79l6MW0sraXJfrCyxXiI/yJ0lQOJI9QOSUpKGe
|
||||
sDBxJ6CQJ8mxZ4oMCfc9aoIspuUXCkG7WOju1w6lfk/iwQoeC0VcGaSq1gXywqvU
|
||||
uZHxIS9zp+GNQPCAJN4OlH5qcf2e3QYECX1igr8xcZfpjnTTKJHzFjzg2mGhc6KG
|
||||
yMDXzU3LyLS5fvUSpITtsgq8ufsSSrkU3SNzUwIDAQABAoIBAA5sdjcKVgiA1b0D
|
||||
FWjL1jFc1gBfDCXoU2ehvUmPQm1H6QkgFmxqFku5NT7lkpVQ8TOC4EOlQ3K5o5qn
|
||||
ASvRDnTmMmwbjQo59LTdwNyXdw5sIzgePtQiJw3fd+eXAHwfB2nBtKK5o8gj78jI
|
||||
LMar4Sdp+j9pr3LKTX4JyYdY703dQ0ZVtRIab3MXAqjUXwZxH16KC0yfz/PVOtVA
|
||||
RtYsDaFujyIlKz0MtsFIT+5FXvpFh44nilavfgypkNXgpoaxRfIxAiVAlHO3WbBW
|
||||
cPC1HwnJ2rb/gBxcmGjSDjxwbPZ7H57O7oI0a6LQjDfz/qu6SlYcuwT7H9CrZMGg
|
||||
gV3DeWkCgYEA4C3P1kJMaLwhMJ1ZgHwdlwAYNQiF4oQMrCFooXEyf841xgfQzveN
|
||||
A0jxjuCuwUYn6pLzjn5qq3jypMoPcMSyw8FkEO1qgJG1osNIvA6T9dRo8kJuEo8X
|
||||
Aefy3R+pydLa8owR/cI87fYizzF9T7BEPqquMAdppr44ErsU6jBrVLUCgYEA/AjI
|
||||
IrHwnI+w/47Mub8+cdTFCrvQn0WAdFMdWsoxNy3k2mZmXm2fi15EMEnMS/d68RLn
|
||||
hhzrVmJEulamJ8L2ZATciIuZdchicG8VudXZmbGwxSPp4M7o293pUXc47lSvgDox
|
||||
9VKbtj5xCVoOypfxUTt2rkNGuVm1pNPDyTtIdOcCgYAjaDjuX1RQKn6XfhK3z2Kh
|
||||
CdvI7Iqw5yhVO4WaEhXmx7wIhg190u2LukakyWnwjtMZIpKjS+YvJRA15NAhgH+3
|
||||
mWDjp4vtuJXWmj9vrGHELwNQWBuohL8ehvL959VaUhpQurzQtpAHCZwf23IuVunA
|
||||
eBbA8TrHoj2a/79i6bjaDQKBgQDySw78K8yA9rLWPFYci/pgPIhhVUWumIZxTiX+
|
||||
TjsaLQjB3Ye0Z/blaO5s7cV1kqmicOYbTFoCZd5ktUBvIUL1zKamrm4NiWL5bBGa
|
||||
4jebRfQG0gvZj5DVLnVLWC5nEQrXXxsAGTaQ8V6B+w4VPhVEXsItrYekUNYLa3nh
|
||||
TxjNKQKBgQCr1EpTOpGE+G3eV3F+PeLpINTAMAr+WTMEL9jhAVmeKoavWWOs+Q6t
|
||||
RV/aG4NIlAQ4ggIOki1Ov6xnQRu0U1i1ZkTubnmcj7mQQFA8AiI3AcBurfxaA/WC
|
||||
nhXqCzi0C6SvQlVOf2jg7Jp7cgBp/UIqzpHMxhVRgz7GmDxAx4rqiA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,27 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAtMjXZrtqu49zffuKVcoXC4hmD4nExuI884P5L1+oE1PbKgKq
|
||||
/c0m7JvDnYU9JQhlrtjBWZXJCozitDicL2lod0/JNG7xsaw5RdL2jiSu5AOJzVJx
|
||||
+s0uh11x1DKFSdKG048RMjFuyWfOZXM3weU/wC4hEZ+Q7kUmlg/yQC5f+/fT7uaw
|
||||
RWRHkPBPcFj3U8DhdIiCy1l1KwHOjUtAey/MlTcTPuKFRpD5LEEfMMIZ0nstPEPa
|
||||
wdAn4R0r4KwmlZhBH30Z+g1C/gqIO0M4WvwH2nziWs/e4c6vJkuSruIeTwl5vdBe
|
||||
1ERP3eKjpyBlnHpRpXA7UeNqBTyMAih3YsgqAwIDAQABAoIBAQCQB7b85PIa7iXw
|
||||
SBglUzVa/dd6J6O7ZAF1bT54zLgGdfeVF70NKYYKWerWM5HMUE1aqNwaOGiMXEQ9
|
||||
myBr8YnGDK3bdUxf5jtW8sV156nihSMjjry6OQAJ3pvSmFFyyCScpk3n9FQ0Z9yb
|
||||
HNleQ/uva9DyznLUMgmU4q15Drlv7uECaCFzvmkoJgjZ0LG0dn3DI83EFPcVakhy
|
||||
Td1vkXRcxys4pxYMyS9XkzmSTlY6sCqHw+n1ioUlhjvV/usnUYu96qGOYnDKcWZN
|
||||
GYrt+TeAXTOTRH5+fDm1RMXoGCGf4XxKJJIOchmKkXf8IdhrJPhHqo5VEfzFYfqr
|
||||
NQPLzur5AoGBAMPpaG3TyFXRTpIh3MkMliub62yexLVLQrmXpmrnOMb2QWSl2sOR
|
||||
It4J4+bNv37flmWL4zCXmZkahys5OdmiRv21T1nlj8AXBRcLdPPSKGUgdpSwHtVH
|
||||
QajRsLie9zYirsCPierUzACd17W6/MfDbFHhDqpECZP/kke0kBDyEp5FAoGBAOw7
|
||||
rO1LSv3SZ4f4+WVRd5GNFIno7Qv08LSr80sTe4aUDYZ4+RfhI558klBmJgbakCX9
|
||||
E+3nBSgcminWjj82CzMDESJWAQxI7Z6nl263oUUP2lzxM39easL8Rm0iDbg1C/7C
|
||||
zqM/fNIFADQt6yQmlXT4VYPbaYnkO5nhCOd7p2+nAoGAeBluW2WpOnLFp+/6WYXN
|
||||
yY4cFMp/7GPm07+T1ZVJyS7Nh9Xk9l7S8Ss++w7GhhCrMjU/YVqOXr1Uf7rlK/W/
|
||||
b2jm7EU+ipOSGz56w73h5ZyxFRWi0TyNk+B4ZbWN9zHrz0AvXDZ3mSkqQ84NiKjU
|
||||
jp1ZUCfFd2UFV8/pQXokz8ECgYEAhc4zX+Ey49xGmiTzFmlzoXTYuli90/T0VlHD
|
||||
J7YsVIkNtCpXZSg35bBHq9SAG4e2+F2F6U3ehN7Wj3Yg8jrpUwacsOcoBs5UEXZ5
|
||||
9tN6PEUDeXuBoNZZAIKmXXBZdwpM9gtfweXXDJqah/OuabaVF0EGJv6jo+ArxjhJ
|
||||
s9w9dacCgYBWTq22aNZubiZFbk+E1NaqqNwEDQeVo6/YLwTvEP2ZzRsI2xAR5hcc
|
||||
R5hTbotkFBo5B0gUqoAMh49qkYbEsn1mjNjkdoztoIh0q2q6G+reCysbG67IQBRO
|
||||
jI9Zco4+7J5JsmvY9h/bxIx+4/U/1h1e0xXJ4m1l1IAtKK9Zb7H2WA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,27 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEA3EV4H327BdG6LOX14YyF9zs0Vi8iOD1239oiATc6+f0QCmbw
|
||||
LB7NUxPcox3rMa3pUqAos6DRUUB6AKmrtjdCVm4DBVPbnFGiNX4QMXmh8s22mPdY
|
||||
JiFsyqlHAvOblqW+sDz8G9vz/dx7K6iTCz1DNiwQvGSCr2zd1oaVQ19hM7JLB3lx
|
||||
Y+o9VWa9q4poBFg57D+SJ/XPTV6aOJzJgGrhiBra6ZIRyA2uEu1llxgD6Tu5cg5F
|
||||
VCcSeLQgqPdrBBN/J3Xn32WbHQI6ooNUefjrjiozuI1lmZOEwwfHvSZlevD008q2
|
||||
UnStFbvJTXM6IkTQoibrjMFAO4fIsuO32xhRRQIDAQABAoIBAFVNgeuQIXFrexIQ
|
||||
LFygsvC/uND3h+UHyJWAQFMANJLDcgbVPoWXmCRoOLXizEZ89zLMW3bU/LreoWDI
|
||||
VHtIgyQ9jmXtx8qNwqe8nkDKvfDtwZ0TjMuXfi4tyBZYiRSaM3LE601OrPrO+9Q4
|
||||
gFmF7BV6kzCiLAoLuw1tKTjiIx6FYX4DFN3zSfO2IyDuxq8R49jUHj37qA8HcLYL
|
||||
6OBfyr/bfaU9KWYAmpfEZT71Z1ms4A7OGgNt8IohTfFy3qEdqfna+Ddm2cZ/OCTe
|
||||
HFlRVo9i3wh2KJkHoD8NCQd6MBVZ7sc45SveVcgLs+eyBEn34IGmHbcW5CDyrTv0
|
||||
rLtos4ECgYEA9ztud6edlkG4b5Fj28gSdeA6iC7He6m2bVhLcpvbqZQObnAYdh9v
|
||||
eRmQu/ZQpkzo6lNrsLocqdceU44Sql0Kaes/SHW5KqzvxZk/gtQpCMks1eCCB+b3
|
||||
BtwUkCmR+cAzFRvSCDufyXifpK52mcGLpDb7ACpOhIAdAByCZ7xUA50CgYEA5BVE
|
||||
MtDVlyZmnuK8PO98pfYSSDUJTuRB0XnUrcv7RqSfoj/U4ta2z/uCswkMYClp6QaG
|
||||
u6RUXVVaAbB9tMpqpodUVlx9V7tjsFhSXzCWeUFnkzq4cVrQhrYJcoSUJI/+gg/u
|
||||
OexZ+fEYy3X5pBcCGG5+b1i375RK9+M4rUep98kCgYEAx2ux9GRIkc3bNmshEEP2
|
||||
2AwRSo3pLI+9bb/dw8mCSuv5JA3ZPVan9RexDlxlu26oJXM6l2fX/QtfE+iyl6bK
|
||||
4pr2Bb2nqYurMEkn2KDHpKWZO7+HQ1aDBY56K7rMW5cz3R/+r9NgVQOuSgjL88QR
|
||||
nlkW55A4m1o3ikJ00bYwUmUCgYBIUMHVxsbh7Kf+2m7KdzgzOojjYgV4gQCpVRJs
|
||||
pE8gP9PpUonB/kfqO5leAJFu79KHsq0HU3v4N7aY8Id6ye70q9W+qAaJyX07DVXY
|
||||
noQnH+iiEq0mK6AQBimKqKR7zzfnrvteXCTPDXVKFTa4ox7j9iyaSyvOh1sZq25t
|
||||
6lnmmQKBgGavNz+vpFrQf43gNmQj8R/I4A+zxQbbrulFLW0r2JTSxXpXgYUO5Q+J
|
||||
oj5HTHdjHXm7sdD1HRSgHe0wHgGR4XeotzDWffxM1o4au8lGZ/zHZnpQEecLPjcU
|
||||
W/skF5EbjMP5unulol4lDkihktV3+6JgUUUoLALeCoe1zfwPmmi4
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,27 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAt0Dkl19VEGF7zTkQBLV50daIkkjx3CfJDSb+A1kqIqopDW26
|
||||
owaimFRr+jwQuEwPJr5iz+CkVfw4BFYxGRMqQYgnT6gfqiZo0pGDfrh5B+OGAyGU
|
||||
n+SUtqboMpf+ilcu9XXowH5KNcF1zw88c/16a/RCJylZih8yqheB8d+8R9hL9EWS
|
||||
X1sbYb0sScSt1FnoBo0tvM7yUX7oHUC2YPn/QIU08KjHYbn5f4HgfdZyYQza6p7n
|
||||
Z2X6zH3k1E3LN5cZPD4+9kO19ggdHZYOYeUn++DwzESCn5YchmMkEyvK0DPfnTwo
|
||||
Y3BewN2ESx01lXJbYLITXKuqpu2S1SKJ98B8qQIDAQABAoIBADpW7m9CalJMtp0f
|
||||
DXpyS9YB9nibwGPWRqtpPnTSbhebFHax+DjuY9UbC0Ue2jPSAwDSm6KSYb7+DNdU
|
||||
mUziTRGPxvQVEf+ZOsXOjY5KLD3WsVNN3YMJwk5j1IhG20Ivf0OlxfOCQR3b+SVy
|
||||
NEy45cB4gpb1Ewxl4jtEQJpAIDC+oMG/0y0JPmlj6pHfwB5nku4iekocQCX7RzYP
|
||||
QBa0PNWvrvNlRJha5DpNHN5zQ2zqg+syKwO0P3oqSjmeAjV4viQmLuBuyDFdLniM
|
||||
TcWVE3FJIsbdkHNJFwDCdxdWFu/UuO9e8KkrQ2pM5X+sLiqdPqKTefQoxfWH5pDP
|
||||
ULF5ZgECgYEA8Liujr8yaozEytFIIw20qIbcIWG8+NcHVsDA/inlxF1GyKAfAtOx
|
||||
I9DtGinVoqtP0DIp1es5ppe8K0qD0WzbKJQlTaXhJivWxFocw0wJp+rmKQIDrauq
|
||||
X+5+WSR9SqT8wa1XGRDxUfGnpzgnmzDiMgJMPLaVWTLA9fhm/lfq83MCgYEAwuJ0
|
||||
NIwtp5KV+fCB0XkzkB2pfBpmqJFL0rgZwSw6eAR25/Uys07TelR0S0phxRtCuZIZ
|
||||
tClV6NbL4SWQs6nQgl0M7hd7MSmJsTuvZlm/tWMVO9CIAYG+EH881/cob5r5XX6F
|
||||
pf7qFffYOMwRT4MMg619C/QwTfDc9IKMzZPuYHMCgYB9COCagtN0JsQ9OPGIS6Ev
|
||||
/ESxDixy8HX+aMaV/js7gNu4b/tLo5uaJ/ZQJbSy9trRII08cR8T2jLCJcVMbYd0
|
||||
j2bE60mEYzb97HSOOJu3XbrJSCOS/NzVUXLNaLevov0quJfKDFPcpXHY2MExyfVj
|
||||
1m+1BX2TxFoYKTuOFyqR4wKBgGKoMz26zQ3s9kGeUInTupe1fGxYDSo+y8yz6E3T
|
||||
bxH86JkKlw0Q1ZwzDuBimlYnM8MvxBVha51Ax9uFodhiGi00n+wUNQgxSARR+7xr
|
||||
qNJRg5lROtjQboB5eTq3Y2AEa0K6XzwmbSiL3Ij8PbMr23T5qbkYeC+sxJ5/THpx
|
||||
7hYjAoGBAJzUSul7/TMPZf0+iidxNeKzgjdQPYRW0tVEvn+6F1+JRiUlXeC2Qnso
|
||||
hVXQMMsxeqPSlUnGaoXc9OujnH8TL7WkkmeUTr63jl7e2nWW1cHh6sC5n9TAzLVG
|
||||
Oj0D7I1yfZWp7EY+ECPfZI232sO5ONR62JizAcLbGTBqSRWs0EdQ
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -102,10 +102,12 @@ func (hbu *httpBlobUpload) Write(p []byte) (n int, err error) {
|
||||
}
|
||||
|
||||
hbu.uuid = resp.Header.Get("Docker-Upload-UUID")
|
||||
hbu.location, err = sanitizeLocation(resp.Header.Get("Location"), hbu.location)
|
||||
location, err := sanitizeLocation(resp.Header.Get("Location"), hbu.location)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
hbu.location = location
|
||||
|
||||
rng := resp.Header.Get("Range")
|
||||
var start, end int
|
||||
if n, err := fmt.Sscanf(rng, "%d-%d", &start, &end); err != nil {
|
||||
|
||||
@@ -124,9 +124,9 @@ func ping(manager challenge.Manager, endpoint string) error {
|
||||
|
||||
// #nosec
|
||||
func newClientSkipVerify() *http.Client {
|
||||
// nosemgrep
|
||||
return &http.Client{
|
||||
Transport: &http.Transport{
|
||||
// nosemgrep
|
||||
TLSClientConfig: &tls.Config{
|
||||
InsecureSkipVerify: true,
|
||||
},
|
||||
|
||||
@@ -223,6 +223,7 @@ func (runtime *ContainerdRuntime) RemoveContainers(containers []string) error {
|
||||
// don't stop on errors, try to remove as many containers as possible
|
||||
errs = append(errs, errors.Wrapf(err, "failed to stop running pod %s: output: %s, error", container, string(out)))
|
||||
} else {
|
||||
// nosemgrep: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
|
||||
out, err = runtime.exec.Command("crictl", "-r", runtime.criSocket, "rmp", container).CombinedOutput()
|
||||
if err != nil {
|
||||
errs = append(errs, errors.Wrapf(err, "failed to remove running container %s: output: %s, error", container, string(out)))
|
||||
@@ -242,6 +243,7 @@ func (runtime *DockerRuntime) RemoveContainers(containers []string) error {
|
||||
// don't stop on errors, try to remove as many containers as possible
|
||||
errs = append(errs, errors.Wrapf(err, "failed to stop running container %s: output: %s, error", container, string(out)))
|
||||
} else {
|
||||
// nosemgrep: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
|
||||
out, err = runtime.exec.Command("docker", "rm", "--volumes", container).CombinedOutput()
|
||||
if err != nil {
|
||||
errs = append(errs, errors.Wrapf(err, "failed to remove running container %s: output: %s, error", container, string(out)))
|
||||
|
||||
@@ -72,9 +72,9 @@ func (p *httpProber) ValidateAndSetDefaults() error {
|
||||
|
||||
func (p *httpProber) Probe(host, port string) error {
|
||||
if p.client == nil {
|
||||
// nosemgrep
|
||||
p.client = &http.Client{
|
||||
Transport: &http.Transport{
|
||||
// nosemgrep
|
||||
TLSClientConfig: &tls.Config{InsecureSkipVerify: p.InsecureSkipVerify},
|
||||
},
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user