This is being added to make it easier to write policy on the contents of
certificate URI SANs. This is where information like SPIFFE IDs etc are
contained and it's helpful to Rego authors to have access to these
values without rebuilding the URI from the parsed data under URIs.
Fixes: #6416
Signed-off-by: Charlie Egan <charlie@styra.com>
Decision logs had previously been configured to hide the value of the
Authorization header, as that is considered sensitive information.
However, there are cases when additional headers are provided that
contain sensitive information, such as the X-AMZ-SECURITY-TOKEN header.
This PR creates an internal map of headers that should be masked, which
can be expanded if additional headers are required. It then loops over
the headers in a request, and performs a lookup on the internal map
to see if any of them match those that should be masked. If so, it
replaces their values with "REDACTED". An existing test was added to
check both the header keys that should be masked, as well as a key
that should not.
Additional work, out of scope for this PR, would be to open a config
setting that would allow users to pass in a list of headers that should
be masked.
Fixes: #5848
Signed-off-by: Colin Lacy <colinjlacy@gmail.com>
This commit changes the string representation of the ident token from
'ident' to 'identifier' as this shows up in error messages and should be
a bit friendlier for users.
Signed-off-by: Torin Sandall <torin@styra.com>
The output is extremely noisy and there does not seem to be a good
reason for it to be enabled all of the time.
Signed-off-by: Torin Sandall <torin@styra.com>
This adds support for rendering of templated strings utilizing Golang's text/template library.
For a given templated string and key/value mapping of template var inputs, this builtin will
inject the values into the template where they are referenced by key.
Fixes#6371
Signed-off-by: Rohan Vasavada <rohanvasavada@gmail.com>
Add two environment variable tests which illustrate how an environment variable can be used in OPA to verify a JWT.
Signed-off-by: Robert Hafner <robert.hafner@sas.com>
This way the object insert operations can return a new object instance.
Before, the object construction for a rule like
p[a][b] := ...
would look like this:
*ir.BlockStmt BlockStmt (1 blocks)
*ir.Block Block (3 statements)
*ir.BlockStmt BlockStmt (1 blocks)
*ir.Block Block (2 statements)
*ir.DotStmt &{Source:{Value:Local<2>} Key:{Value:Local<10>} Target:Local<14>}
*ir.BreakStmt &{Index:1}
*ir.MakeObjectStmt &{Target:Local<14>}
*ir.ObjectInsertOnceStmt &{Key:{Value:Local<10>} Value:{Value:Local<14>} Object:Local<2>}
*ir.ObjectInsertOnceStmt &{Key:{Value:Local<11>} Value:{Value:Local<13>} Object:Local<14>}
Now, it'll look like
*ir.BlockStmt BlockStmt (1 blocks)
*ir.Block Block (2 statements)
*ir.BlockStmt BlockStmt (1 blocks)
*ir.Block Block (2 statements)
*ir.DotStmt &{Source:{Value:Local<2>} Key:{Value:Local<10>} Target:Local<14>}
*ir.BreakStmt &{Index:1}
*ir.MakeObjectStmt &{Target:Local<14>}
*ir.ObjectInsertOnceStmt &{Key:{Value:Local<11>} Value:{Value:Local<13>} Object:Local<14>}
*ir.ObjectInsertStmt &{Key:{Value:Local<10>} Value:{Value:Local<14>} Object:Local<2>}
so the object in Local<14> is built first, and the added to object Local<2>.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Co-authored-by: Teemu Koponen <koponen@styra.com>
This version includes security fixes which addresses
vulnerability GO-2023-2186 and GO-2023-2185.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Repeating the name of the file in each location is often redundant,
and large AST trees carry thousands of these attributes. Providing
an option to have them removed at least for serialization (as anything
more would be a breaking change) seems like a good compromise.
For reference, see https://github.com/StyraInc/regal/issues/408
Signed-off-by: Anders Eknert <anders@styra.com>
When feeding a `char *` into `re->Match()`, it was converted to a StringPiece,
taking its size as `strlen()`. For our (long) input, that wasn't resulting in
the correct size, and did then freak out the re2 match input validation if the
regular expression has an end anchor, but the endpos wasn't the same as its
length. Since the endpos was taken from `s->len`, and the "length" taken via
the mentioned StringPiece's strlen() call, they did indeed not match.
Worked around by feeding it a properly-constructed std::string instead. I'm a
C++ novice at best, but it does the trick, and I'm reasonable certain it's less
wrong than before.
Fixes#6376.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Basically lifting this compiler optiimization for the Wasm compiler into the planning stage: If we already know at plan time that a certain (in)equality check fails/succeeds, we don't need to do it. The less work, the better.
* planner: don't emit `NotEqualStmt{A: ..., B: false}` where superfluous
* planner: don't emit `EqualStmt{A: x, B: x}`
for string and bool constants
* compiler/wasm: remove optimizations
Signed-off-by: Stephan Renatus <stephan@styra.com>
All published OPA images now run with a non-root uid/gid.
The uid:gid is set to 1000:1000 for all images. As a result
there is no longer a need for the --rootless image variant
hence it will not be published as part of future releases.
This change is in line with container security best practices.
OPA can still be run with root privileges by explicitly setting the user,
either with the --user argument for docker run, or by specifying
the securityContext in the Kubernetes Pod specification.
Fixes: #4295
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
for rules/functions that only has value assignment for `else` but not "primary" head, when `rego.v1` is imported.
Fixes: #6364
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Johan Fylling