Skip to content

Commit 47dbc64

Browse files
fairclothjmfairclothjm
authored
fix wildcard handling when field contains dot (#542)
* fix wildcard handling when field contains dot * changelog
1 parent 66531b2 commit 47dbc64

4 files changed

Lines changed: 62 additions & 28 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
## Unreleased
22

3+
Improvements:
4+
5+
* fix wildcard handling when field contains dot [GH-542](https://github.com/hashicorp/vault-action/pull/542)
6+
37
Features:
48

59
* `secretId` is no longer required for approle to support advanced use cases like machine login when `bind_secret_id` is false. [GH-522](https://github.com/hashicorp/vault-action/pull/522)

‎dist/index.js‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -18999,28 +18999,34 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
1899918999

1900019000
body = JSON.parse(body);
1900119001

19002-
if (selector == WILDCARD) {
19002+
if (selector == WILDCARD) {
1900319003
let keys = body.data;
1900419004
if (body.data["data"] != undefined) {
1900519005
keys = keys.data;
1900619006
}
1900719007

1900819008
for (let key in keys) {
1900919009
let newRequest = Object.assign({},secretRequest);
19010-
newRequest.selector = key;
19011-
19010+
newRequest.selector = key;
19011+
1901219012
if (secretRequest.selector === secretRequest.outputVarName) {
1901319013
newRequest.outputVarName = key;
19014-
newRequest.envVarName = key;
19015-
}
19016-
else {
19014+
newRequest.envVarName = key;
19015+
} else {
1901719016
newRequest.outputVarName = secretRequest.outputVarName+key;
19018-
newRequest.envVarName = secretRequest.envVarName+key;
19017+
newRequest.envVarName = secretRequest.envVarName+key;
1901919018
}
1902019019

1902119020
newRequest.outputVarName = normalizeOutputKey(newRequest.outputVarName);
19022-
newRequest.envVarName = normalizeOutputKey(newRequest.envVarName,true);
19023-
19021+
newRequest.envVarName = normalizeOutputKey(newRequest.envVarName,true);
19022+
19023+
// JSONata field references containing reserved tokens should
19024+
// be enclosed in backticks
19025+
// https://docs.jsonata.org/simple#examples
19026+
if (key.includes(".")) {
19027+
const backtick = '`';
19028+
key = backtick.concat(key, backtick);
19029+
}
1902419030
selector = key;
1902519031

1902619032
results = await selectAndAppendResults(
@@ -19034,13 +19040,13 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
1903419040
}
1903519041
else {
1903619042
results = await selectAndAppendResults(
19037-
selector,
19038-
body,
19039-
cachedResponse,
19040-
secretRequest,
19043+
selector,
19044+
body,
19045+
cachedResponse,
19046+
secretRequest,
1904119047
results
1904219048
);
19043-
}
19049+
}
1904419050
}
1904519051

1904619052
return results;

‎integrationTests/basic/integration.test.js‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,14 @@ describe('integration', () => {
3131
},
3232
});
3333

34+
await got(`${vaultUrl}/v1/secret/data/test-with-dot-char`, {
35+
method: 'POST',
36+
headers: {
37+
'X-Vault-Token': vaultToken,
38+
},
39+
body: `{"data":{"secret.foo":"SUPERSECRET"}}`
40+
});
41+
3442
await got(`${vaultUrl}/v1/secret/data/nested/test`, {
3543
method: 'POST',
3644
headers: {
@@ -193,6 +201,16 @@ describe('integration', () => {
193201
expect(core.exportVariable).toBeCalledWith('OTHERSECRETDASH', 'OTHERSUPERSECRET');
194202
});
195203

204+
it('get wildcard secrets with dot char', async () => {
205+
mockInput(`secret/data/test-with-dot-char * ;`);
206+
207+
await exportSecrets();
208+
209+
expect(core.exportVariable).toBeCalledTimes(1);
210+
211+
expect(core.exportVariable).toBeCalledWith('SECRET__FOO', 'SUPERSECRET');
212+
});
213+
196214
it('get wildcard secrets', async () => {
197215
mockInput(`secret/data/test * ;`);
198216

‎src/secrets.js‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -59,28 +59,34 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
5959

6060
body = JSON.parse(body);
6161

62-
if (selector == WILDCARD) {
62+
if (selector == WILDCARD) {
6363
let keys = body.data;
6464
if (body.data["data"] != undefined) {
6565
keys = keys.data;
6666
}
6767

6868
for (let key in keys) {
6969
let newRequest = Object.assign({},secretRequest);
70-
newRequest.selector = key;
71-
70+
newRequest.selector = key;
71+
7272
if (secretRequest.selector === secretRequest.outputVarName) {
7373
newRequest.outputVarName = key;
74-
newRequest.envVarName = key;
75-
}
76-
else {
74+
newRequest.envVarName = key;
75+
} else {
7776
newRequest.outputVarName = secretRequest.outputVarName+key;
78-
newRequest.envVarName = secretRequest.envVarName+key;
77+
newRequest.envVarName = secretRequest.envVarName+key;
7978
}
8079

8180
newRequest.outputVarName = normalizeOutputKey(newRequest.outputVarName);
82-
newRequest.envVarName = normalizeOutputKey(newRequest.envVarName,true);
83-
81+
newRequest.envVarName = normalizeOutputKey(newRequest.envVarName,true);
82+
83+
// JSONata field references containing reserved tokens should
84+
// be enclosed in backticks
85+
// https://docs.jsonata.org/simple#examples
86+
if (key.includes(".")) {
87+
const backtick = '`';
88+
key = backtick.concat(key, backtick);
89+
}
8490
selector = key;
8591

8692
results = await selectAndAppendResults(
@@ -94,13 +100,13 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
94100
}
95101
else {
96102
results = await selectAndAppendResults(
97-
selector,
98-
body,
99-
cachedResponse,
100-
secretRequest,
103+
selector,
104+
body,
105+
cachedResponse,
106+
secretRequest,
101107
results
102108
);
103-
}
109+
}
104110
}
105111

106112
return results;

0 commit comments

Comments
 (0)