From fac0622499357bf1f2c4e6a5b29dc1b16864efb7 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Mon, 27 Apr 2026 18:46:42 +0300 Subject: [PATCH] fix(postgres): make security denylist case-insensitive PostgreSQL parameter names are case-insensitive, but the denylist check was case-sensitive, allowing bypass via mixed-case names (e.g., ARCHIVE_COMMAND instead of archive_command). Normalize parameter names to lowercase before checking against the denylist to prevent security bypass. Thanks to CodeRabbit for catching this security issue. Signed-off-by: IvanHunters --- packages/apps/postgres/templates/db.yaml | 3 ++- .../PrometheusRule.yaml => templates/prometheusrule.yaml} | 0 2 files changed, 2 insertions(+), 1 deletion(-) rename packages/system/kubevirt-operator/{alerts/PrometheusRule.yaml => templates/prometheusrule.yaml} (100%) diff --git a/packages/apps/postgres/templates/db.yaml b/packages/apps/postgres/templates/db.yaml index de8c24f7..6c1fda12 100644 --- a/packages/apps/postgres/templates/db.yaml +++ b/packages/apps/postgres/templates/db.yaml @@ -65,7 +65,8 @@ spec: {{- /* Security: Block parameters that could allow shell command execution */ -}} {{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "log_destination" "event_source" }} {{- range $key, $value := $params }} - {{- if has $key $dangerousParams }} + {{- $normalizedKey := lower $key }} + {{- if has $normalizedKey $dangerousParams }} {{- fail (printf "SECURITY: Parameter '%s' is blocked for security reasons. This parameter could allow arbitrary shell command execution and is managed by CloudNativePG operator." $key) }} {{- end }} {{ $key }}: {{ $value | quote }} diff --git a/packages/system/kubevirt-operator/alerts/PrometheusRule.yaml b/packages/system/kubevirt-operator/templates/prometheusrule.yaml similarity index 100% rename from packages/system/kubevirt-operator/alerts/PrometheusRule.yaml rename to packages/system/kubevirt-operator/templates/prometheusrule.yaml