nolar / kopf / 1093

85%

main: 91%

push

travis-ci

Secure the log strings from injections and for better template-matching

Generally, we can trust the codebase of the operators, as only
the code owners can inject arbitrary handler ids or task names.
But in case they are dynamic and use the data from the CR-users,
this can lead to log template injections and cause errors of DoS
(mostly when at least some positional args are passed to loggers).

We can make it a bit more secure by not using any f-strings
in the log message templates, unless the variables come strictly
from Kopf, not even from the Kopf-based operators.

This also improves the template-matching: the logging handlers
and formatters get the template strings with %s/%r instead of
actual variable values which differ every time, so they report
these messages by their proper templates (e.g. in Sentry).

634 of 819 branches covered (77.41%)

Branch coverage included in aggregate %.

2399 of 2831 relevant lines covered (84.74%)

4.24 hits per line