From c178f896629e7b7eb684ec96fe22d8e2ad9024b4 Mon Sep 17 00:00:00 2001 From: Adrian Utrilla Date: Wed, 10 Mar 2021 21:47:43 +0100 Subject: [PATCH] Revert "Match file path relative to config file's directory (#827)" This reverts commit dd7ce3d2cb25e2e913a344572b64b81e6b9a947e. --- README.rst | 2 +- config/config.go | 15 ++------------ config/config_test.go | 47 ++++++++++++++----------------------------- 3 files changed, 18 insertions(+), 46 deletions(-) diff --git a/README.rst b/README.rst index 53800f8c7..4c4ed0eec 100644 --- a/README.rst +++ b/README.rst @@ -650,7 +650,7 @@ and its KMS and PGP keys are used to encrypt the file. It should be noted that the looking up of ``.sops.yaml`` is from the working directory (CWD) instead of the directory of the encrypting file (see `Issue 242 `_). -The path_regex checks the path of the encrypting file relative to the .sops.yaml config file. Here is another example: +The path_regex checks the full path of the encrypting file. Here is another example: * files located under directory **development** should use one set of KMS A * files located under directory **production** should use another set of KMS B diff --git a/config/config.go b/config/config.go index 061d038e2..e89336ddc 100644 --- a/config/config.go +++ b/config/config.go @@ -8,9 +8,7 @@ import ( "io/ioutil" "os" "path" - "path/filepath" "regexp" - "strings" "github.com/sirupsen/logrus" "go.mozilla.org/sops/v3" @@ -315,20 +313,12 @@ func parseDestinationRuleForFile(conf *configFile, filePath string, kmsEncryptio return config, nil } -func parseCreationRuleForFile(conf *configFile, confPath, filePath string, kmsEncryptionContext map[string]*string) (*Config, error) { +func parseCreationRuleForFile(conf *configFile, filePath string, kmsEncryptionContext map[string]*string) (*Config, error) { // If config file doesn't contain CreationRules (it's empty or only contains DestionationRules), assume it does not exist if conf.CreationRules == nil { return nil, nil } - configDir, err := filepath.Abs(filepath.Dir(confPath)) - if err != nil { - return nil, err - } - - // compare file path relative to path of config file - filePath = strings.TrimPrefix(filePath, configDir + string(filepath.Separator)) - var rule *creationRule for _, r := range conf.CreationRules { @@ -366,8 +356,7 @@ func LoadCreationRuleForFile(confPath string, filePath string, kmsEncryptionCont if err != nil { return nil, err } - - return parseCreationRuleForFile(conf, confPath, filePath, kmsEncryptionContext) + return parseCreationRuleForFile(conf, filePath, kmsEncryptionContext) } // LoadDestinationRuleForFile works the same as LoadCreationRuleForFile, but gets the "creation_rule" from the matching destination_rule's diff --git a/config/config_test.go b/config/config_test.go index c1d723417..ac8aca6f3 100644 --- a/config/config_test.go +++ b/config/config_test.go @@ -75,15 +75,6 @@ creation_rules: hc_vault_uris: https://foz:443/v1/foz/keys/foz `) -var sampleConfigWithAmbiguousPath = []byte(` -creation_rules: - - path_regex: foo/* - kms: "1" - pgp: "2" - gcp_kms: "3" - hc_vault_uris: http://4:8200/v1/4/keys/4 -`) - var sampleConfigWithGroups = []byte(` creation_rules: - path_regex: foobar* @@ -308,7 +299,7 @@ func TestLoadConfigFileWithGroups(t *testing.T) { } func TestLoadConfigFileWithNoMatchingRules(t *testing.T) { - _, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithNoMatchingRules, t), "/conf/path", "foobar2000", nil) + _, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithNoMatchingRules, t), "foobar2000", nil) assert.NotNil(t, err) } @@ -331,51 +322,51 @@ func TestLoadConfigFileWithComplicatedRegexp(t *testing.T) { } func TestLoadEmptyConfigFile(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleEmptyConfig, t), "/conf/path", "foobar2000", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleEmptyConfig, t), "foobar2000", nil) assert.Nil(t, conf) assert.Nil(t, err) } func TestLoadConfigFileWithEmptyCreationRules(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithEmptyCreationRules, t), "/conf/path", "foobar2000", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithEmptyCreationRules, t), "foobar2000", nil) assert.Nil(t, conf) assert.Nil(t, err) } func TestLoadConfigFileWithOnlyDestinationRules(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithOnlyDestinationRules, t), "/conf/path", "foobar2000", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithOnlyDestinationRules, t), "foobar2000", nil) assert.Nil(t, conf) assert.Nil(t, err) } func TestKeyGroupsForFile(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "/conf/path", "foobar2000", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "foobar2000", nil) assert.Nil(t, err) assert.Equal(t, "2", conf.KeyGroups[0][0].ToString()) assert.Equal(t, "1", conf.KeyGroups[0][1].ToString()) - conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "/conf/path", "whatever", nil) + conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "whatever", nil) assert.Nil(t, err) assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString()) assert.Equal(t, "foo", conf.KeyGroups[0][1].ToString()) } func TestKeyGroupsForFileWithPath(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "/conf/path", "foo/bar2000", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "foo/bar2000", nil) assert.Nil(t, err) assert.Equal(t, "2", conf.KeyGroups[0][0].ToString()) assert.Equal(t, "1", conf.KeyGroups[0][1].ToString()) - conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "/conf/path", "somefilename.yml", nil) + conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "somefilename.yml", nil) assert.Nil(t, err) assert.Equal(t, "baggins", conf.KeyGroups[0][0].ToString()) assert.Equal(t, "bilbo", conf.KeyGroups[0][1].ToString()) - conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "/conf/path", "whatever", nil) + conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "whatever", nil) assert.Nil(t, err) assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString()) assert.Equal(t, "foo", conf.KeyGroups[0][1].ToString()) } func TestKeyGroupsForFileWithGroups(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithGroups, t), "/conf/path", "whatever", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithGroups, t), "whatever", nil) assert.Nil(t, err) assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString()) assert.Equal(t, "foo", conf.KeyGroups[0][1].ToString()) @@ -384,39 +375,31 @@ func TestKeyGroupsForFileWithGroups(t *testing.T) { } func TestLoadConfigFileWithUnencryptedSuffix(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "/conf/path", "foobar", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "foobar", nil) assert.Nil(t, err) assert.Equal(t, "_unencrypted", conf.UnencryptedSuffix) } func TestLoadConfigFileWithEncryptedSuffix(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "/conf/path", "barfoo", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "barfoo", nil) assert.Nil(t, err) assert.Equal(t, "_enc", conf.EncryptedSuffix) } func TestLoadConfigFileWithUnencryptedRegex(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "/conf/path", "barbar", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "barbar", nil) assert.Equal(t, nil, err) assert.Equal(t, "^dec:", conf.UnencryptedRegex) } func TestLoadConfigFileWithEncryptedRegex(t *testing.T) { - conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "/conf/path", "barbar", nil) + conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "barbar", nil) assert.Equal(t, nil, err) assert.Equal(t, "^enc:", conf.EncryptedRegex) } func TestLoadConfigFileWithInvalidParameters(t *testing.T) { - _, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithInvalidParameters, t), "/conf/path", "foobar", nil) - assert.NotNil(t, err) -} - -func TestLoadConfigFileWithAmbiguousPath(t *testing.T) { - config := parseConfigFile(sampleConfigWithAmbiguousPath, t) - _, err := parseCreationRuleForFile(config, "/foo/config", "/foo/foo/bar", nil) - assert.Nil(t, err) - _, err = parseCreationRuleForFile(config, "/foo/config", "/foo/fuu/bar", nil) + _, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithInvalidParameters, t), "foobar", nil) assert.NotNil(t, err) }