diff --git a/go.mod b/go.mod index 3f390a4899..30816e6074 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/spf13/pflag v1.0.10 github.com/tektoncd/chains v0.26.5 github.com/tektoncd/hub v1.23.1 - github.com/tektoncd/pipeline v1.9.3 + github.com/tektoncd/pipeline v1.9.5 github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 github.com/tektoncd/triggers v0.34.0 github.com/theupdateframework/go-tuf v0.7.0 diff --git a/go.sum b/go.sum index 3f46c941b7..2488da6971 100644 --- a/go.sum +++ b/go.sum @@ -1238,8 +1238,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo= github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs= -github.com/spiffe/spire-api-sdk v1.14.0 h1:72Ywh9Mq/Zd2irveBEFIh0LFLG8/KYTltkVkBluPd0A= -github.com/spiffe/spire-api-sdk v1.14.0/go.mod h1:9hXJcMzatM1KwAtBDO3s6HccDCic++/5c2yOc5Iln8Y= +github.com/spiffe/spire-api-sdk v1.14.7 h1:dIloXcIxSGhGy5LnOCJUVjUj3QsRvuSb5L9goJZTloc= +github.com/spiffe/spire-api-sdk v1.14.7/go.mod h1:9hXJcMzatM1KwAtBDO3s6HccDCic++/5c2yOc5Iln8Y= github.com/sqs/goreturns v0.0.0-20181028201513-538ac6014518/go.mod h1:CKI4AZ4XmGV240rTHfO0hfE83S6/a3/Q1siZJ/vXf7A= github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw= @@ -1273,8 +1273,8 @@ github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDd github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48= github.com/tektoncd/chains v0.26.5 h1:X5W0oBsqK3wRz89IgY1kPIokhI6N1a1E1oreZgwJNwI= github.com/tektoncd/chains v0.26.5/go.mod h1:qUe7YfRPTJuEAwFFq3R7VPaOYCVNQRh5HCLqiIqO40I= -github.com/tektoncd/pipeline v1.9.3 h1:7Z+V2VX5wjz9LoNa16E1RbgH9mpYy5B1KnAMm3H0czc= -github.com/tektoncd/pipeline v1.9.3/go.mod h1:pEruzPp4JM8JK8Nnnih46IPgdtxRPot/i9pUZo8lA9I= +github.com/tektoncd/pipeline v1.9.5 h1:WNgCcsuSrGjlpuBwfGgf2YGI1KkHMm4TwtoG+gPC0AE= +github.com/tektoncd/pipeline v1.9.5/go.mod h1:6NHcPJCZAUhnWHK0ZcYvO0PXpBKD7kcer+oYdxPMGTU= github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 h1:nv7BsOAZ1ifQX9Lw1hYFo1f7e62dTDyyVPJBuljgZKw= github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1/go.mod h1:eDs4O8vTNkyKZ/+AEuo4nYDfpyn1AzbgIcQ1QMQaKJk= github.com/tektoncd/triggers v0.34.0 h1:CuhG1moThPGEMlxPUcoBDDplJ3FAczzF8MMAjGScRY0= diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go index d6276bdef0..ed792c2011 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go @@ -23,6 +23,8 @@ import ( "knative.dev/pkg/kmeta" ) +const StepActionKind = "StepAction" + // +genclient // +genclient:noStatus // +genreconciler:krshapedlogic=false @@ -62,7 +64,7 @@ func (s *StepAction) Copy() StepActionObject { // GetGroupVersionKind implements kmeta.OwnerRefable. func (*StepAction) GetGroupVersionKind() schema.GroupVersionKind { - return SchemeGroupVersion.WithKind("StepAction") + return SchemeGroupVersion.WithKind(StepActionKind) } // Checksum computes the sha256 checksum of the stepaction object. diff --git a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go index 89c1e897a7..ca8154dea9 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go @@ -18,9 +18,14 @@ package framework import ( "context" + "fmt" + "slices" "time" + pipelineapi "github.com/tektoncd/pipeline/pkg/apis/pipeline" pipelinev1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + "sigs.k8s.io/yaml" ) // Resolver is the interface to implement for type-specific resource @@ -100,3 +105,23 @@ type ResolvedResource interface { Annotations() map[string]string RefSource() *pipelinev1.RefSource } + +// ValidateResolvedResource validates that the ResolvedResource's data is a +// kubernetes object and a Tekton kind. This ensures non-k8s data (e.g. tokens) or non-tekton +// k8s objects (e.g. Secrets) are not written into the unprivileged ResolutionRequest objects. +func ValidateResolvedResource(resource ResolvedResource) error { + var metadata struct { + APIVersion string + Kind string + } + if err := yaml.Unmarshal(resource.Data(), &metadata); err != nil { + return fmt.Errorf("decoding error: %w", err) + } + // gv is not nil when there is an error + gv, _ := schema.ParseGroupVersion(metadata.APIVersion) + + if gv.Group != pipelineapi.GroupName || !slices.Contains(allowedResourceKinds, metadata.Kind) { + return fmt.Errorf("resolved data is not of a supported type, must be of Group: %s, Kinds: %v", pipelineapi.GroupName, allowedResourceKinds) + } + return nil +} diff --git a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go index 314d801c2b..6ae027aeb5 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go @@ -24,6 +24,7 @@ import ( "fmt" "time" + pipelineapi "github.com/tektoncd/pipeline/pkg/apis/pipeline" pipelinev1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" pipelinev1beta1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1" "github.com/tektoncd/pipeline/pkg/apis/resolution/v1beta1" @@ -71,6 +72,18 @@ var _ reconciler.LeaderAware = &Reconciler{} // the framework.TimedResolution interface. const defaultMaximumResolutionDuration = time.Minute +// allowedResourceKinds lists the kinds of resources which +// are allowed to be resolved by resolvers +var allowedResourceKinds = []string{ + pipelineapi.PipelineRunControllerName, + pipelineapi.PipelineControllerName, + pipelineapi.TaskRunControllerName, + pipelineapi.TaskControllerName, + pipelineapi.RunControllerName, + pipelineapi.CustomRunControllerName, + pipelinev1beta1.StepActionKind, +} + // Reconcile receives the string key of a ResolutionRequest object, looks // it up, checks it for common errors, and then delegates // resolver-specific functionality to the reconciler's embedded @@ -106,8 +119,8 @@ func (r *Reconciler) Reconcile(ctx context.Context, key string) error { } func (r *Reconciler) resolve(ctx context.Context, key string, rr *v1beta1.ResolutionRequest) error { - errChan := make(chan error) - resourceChan := make(chan ResolvedResource) + errChan := make(chan error, 1) + resourceChan := make(chan ResolvedResource, 1) paramsMap := make(map[string]string) for _, p := range rr.Spec.Params { @@ -147,6 +160,14 @@ func (r *Reconciler) resolve(ctx context.Context, key string, rr *v1beta1.Resolu } return } + if err := ValidateResolvedResource(resource); err != nil { + errChan <- &resolutioncommon.GetResourceError{ + ResolverName: r.resolver.GetName(resolutionCtx), + Key: key, + Original: fmt.Errorf("resolved resource validation error: %w", err), + } + return + } resourceChan <- resource }() diff --git a/vendor/modules.txt b/vendor/modules.txt index 093b6f0baa..d40619e452 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1548,8 +1548,8 @@ github.com/tektoncd/hub/api/v1/gen/http/catalog/client github.com/tektoncd/hub/api/v1/gen/http/resource/client github.com/tektoncd/hub/api/v1/gen/resource github.com/tektoncd/hub/api/v1/gen/resource/views -# github.com/tektoncd/pipeline v1.9.3 -## explicit; go 1.24.13 +# github.com/tektoncd/pipeline v1.9.5 +## explicit; go 1.25.6 github.com/tektoncd/pipeline/internal/artifactref github.com/tektoncd/pipeline/pkg/apis/config github.com/tektoncd/pipeline/pkg/apis/config/resolver