Skip to content

Update Event recorder to not parse % format characters in error message#838

Merged
negz merged 1 commit intocrossplane:mainfrom
chlunde:unfmt
May 21, 2025
Merged

Update Event recorder to not parse % format characters in error message#838
negz merged 1 commit intocrossplane:mainfrom
chlunde:unfmt

Conversation

@chlunde
Copy link
Copy Markdown
Contributor

@chlunde chlunde commented May 19, 2025

*Eventf takes a format string. This change passes "%s" as the format string
and then the unsanitized string as an argument.

Fixes #837

Description of your changes

I have:

Need help with this checklist? See the cheat sheet.

*Eventf takes a format string. This change passes "%s" as the format string
and then the unsanitized string as an argument.

Fixes crossplane#837

Signed-off-by: Carl Henrik Lunde <chlunde@ifi.uio.no>
@chlunde chlunde requested a review from a team as a code owner May 19, 2025 18:43
@chlunde chlunde requested a review from jbw976 May 19, 2025 18:43
// Event records the supplied event.
func (r *APIRecorder) Event(obj runtime.Object, e Event) {
r.kube.AnnotatedEventf(obj, r.annotations, string(e.Type), string(e.Reason), e.Message)
r.kube.AnnotatedEventf(obj, r.annotations, string(e.Type), string(e.Reason), "%s", e.Message)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there an AnnotatedEvent (non-f) variant we could use instead?

Copy link
Copy Markdown
Contributor Author

@chlunde chlunde May 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not with Annotated, just Event without f, as far as I could see: https://github.com/kubernetes/client-go/blob/master/tools/record/event.go#L92-L111

@negz negz merged commit 532a1c4 into crossplane:main May 21, 2025
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Format string injection in events

2 participants