Brace yourselves! For there are many touched files here. No changes
in semantics however.
Spent a long time trying out the various optional rules gocritic
provides, and settled for a few of them. There are more I really
like, but that would take many hours to address across the codebase.
Perhaps others find gocritic too pedantic? If so, we can merge the
fixes without enabling the rule.
Signed-off-by: Anders Eknert <anders@styra.com>
**main**
```
BenchmarkLintAllEnabled-10 1 2640715625 ns/op 6385110200 B/op 116296633 allocs/op
```
**pr**
```
BenchmarkLintAllEnabled-10 1 2597179708 ns/op 6183614112 B/op 108421141 allocs/op
```
(I renamed the benchmark, but this is the same as "regal linting itself"
used in the past)
Another 8 million allocations cut off from `regal lint bundle`,
and a whopping 10% improvements to wall clock time!
The most significant improvement is the Equal implementation for
refs, since that is called all over the place. But there are many
other fixes here, and they all contribute something substantial
(and fixes that only have had marginal impact have been left out).
Signed-off-by: Anders Eknert <anders@styra.com>
The impact of this in OPA is minimal: when passing for example
--set "abc[9999999999999]=123"
to `opa run` or `opa exec`, it would run out of memory. With this change, it
will return an error instead:
$ opa exec --set "abc[9999999999999]=123" .
{"err":"config error: failed parsing --set data: index of 9999999999999 is greater than maximum supported index of 65536",
"level":"error","msg":"Unexpected error.","time":"2022-10-27T10:24:01+02:00"}
Since these parameters are never user-controlled, or accessible at
runtime, any attack vector here involves having access to a machines
CLI, and is thus equivalent to already having local user rights. The
affected instance of OPA would be the instance that is started -- so no
others would be affected.
Thanks to @pjbgf for bringing this up on the security mailing list.
See also the issue in helm,
https://github.com/fluxcd/flux2/security/advisories/GHSA-p2g7-xwvr-rrw3.
The changes have been ported from @mattfarina fix in
https://github.com/helm/helm/commit/225f8d7732aba378378e7507655157b1d26cd514.
More stuff has happened on that package in helm, and new features have been
added -- but I've refrained from pulling all that in.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit updates the parser for --set options
to return empty struct as return value when null
is specified. This is needed to set an empty object
with the CLI overrides for a null typed value.
Fixes: #3846
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
golint is deprecated. The author of the code no longer supports the
codebase. golangci-lint is faster than golint, and is in use by other
opa repositories (e.g. Gatekeeper).
This commit changes tools.go to reference golangci (so it ends up in
vendor) and modifies check-lint to use golangci instead.
Breaking API Changes:
- plugins/rest/rest.go: Fix typo "AllowInsureTLS" -> "AllowInsecureTLS"
- storage/errors.go: Removed unused IndexingNotSupportedErr
Signed-off-by: Will Beason <willbeason@google.com>
Anders Eknert