kubernetes-sigs / blob-csi-driver / 40880756423

83%

master: 83%

Pull #2728

github

Block NFS protocols for inline (ephemeral) volumes

Inline/ephemeral CSI volumes build the NFS mount source directly
from the pod-controlled "server" attribute. An attacker with pod
spec control could inject extra mount arguments affecting the
node, outside the container (CWE-88, argument injection).

Reject nfs/aznfs/nfsv3 protocol for inline volumes outright in
NodeStageVolume, before any attacker-controlled attribute is
used to build a mount source. PV-based NFS volumes are
unaffected since server/account values come from a trusted
StorageClass/PV.

3 of 3 new or added lines in 1 file covered. (100.0%)

3321 of 3979 relevant lines covered (83.46%)

14.88 hits per line