parent
7ebc8ff5fe
commit
04292f1375
8 changed files with 66 additions and 50 deletions
|
@ -1,19 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -e +o pipefail
|
||||
|
||||
# bit too spammy
|
||||
return
|
||||
|
||||
if [ "$TRAVIS_PULL_REQUEST" != "false" ] ; then
|
||||
echo -e "NOTE: The CPU benchmarks are performed on Travis VMs and vary wildly between runs," > .benchmark.body
|
||||
echo -e " you can't trust them. The memory benchmarks are OK\n\n" >> .benchmark.body
|
||||
awk '/^benchmark.*old/ { printf "%s\n%s\n", "```", $0 };
|
||||
/^$/ { print "```" };
|
||||
/^Bench/ { print $0 };
|
||||
END{ print "```" }' .benchmark.log >> .benchmark.body
|
||||
jq -n --arg body "$(cat .benchmark.body)" '{body: $body}' > .benchmark.json
|
||||
curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST \
|
||||
--data-binary "@.benchmark.json" \
|
||||
"https://api.github.com/repos/${TRAVIS_REPO_SLUG}/issues/${TRAVIS_PULL_REQUEST}/comments"
|
||||
fi
|
20
.github/SECURITY.md
vendored
20
.github/SECURITY.md
vendored
|
@ -6,7 +6,7 @@ to ensure responsible handling of critical issues.
|
|||
|
||||
## Product Security Team (PST)
|
||||
|
||||
Security vulnerabilities should be handled quickly and sometimes privately.
|
||||
Security vulnerabilities should be handled quickly and sometimes privately.
|
||||
The primary goal of this process is to reduce the total time users are vulnerable to publicly known exploits.
|
||||
|
||||
The Product Security Team (PST) is responsible for organizing the entire response including internal communication and external disclosure.
|
||||
|
@ -23,7 +23,7 @@ The initial Product Security Team will consist of the set of maintainers that vo
|
|||
|
||||
### Private Disclosure Processes
|
||||
|
||||
If you find a security vulnerability or any security related issues,
|
||||
If you find a security vulnerability or any security related issues,
|
||||
please DO NOT file a public issue. Do not create a Github issue.
|
||||
Instead, send your report privately to security@coredns.io.
|
||||
Security reports are greatly appreciated and we will publicly thank you for it.
|
||||
|
@ -36,7 +36,7 @@ For instance, that could include:
|
|||
|
||||
### Public Disclosure Processes
|
||||
|
||||
If you know of a publicly disclosed security vulnerability please IMMEDIATELY email security@coredns.io
|
||||
If you know of a publicly disclosed security vulnerability please IMMEDIATELY email security@coredns.io
|
||||
to inform the Product Security Team (PST) about the vulnerability so we start the patch, release, and communication process.
|
||||
|
||||
If possible the PST will ask the person making the public report if the issue can be handled via a private disclosure process
|
||||
|
@ -56,7 +56,7 @@ Note that given the current size of the CoreDNS community it is likely that the
|
|||
The PST may decide to bring in additional contributors for added expertise depending on the area of the code that contains the vulnerability.
|
||||
|
||||
All of the timelines below are suggestions and assume a Private Disclosure.
|
||||
If the Team is dealing with a Public Disclosure all timelines become ASAP.
|
||||
If the Team is dealing with a Public Disclosure all timelines become ASAP.
|
||||
If the fix relies on another upstream project's disclosure timeline, that will adjust the process as well.
|
||||
We will work with the upstream project to fit their timeline and best protect our users.
|
||||
|
||||
|
@ -88,14 +88,14 @@ discussed on the security@coredns.io mailing list.
|
|||
|
||||
### Fix Disclosure Process
|
||||
|
||||
With the Fix Development underway the CoreDNS Security Team needs to come up with an overall communication plan for the wider community.
|
||||
This Disclosure process should begin after the Team has developed a fix or mitigation
|
||||
With the Fix Development underway the CoreDNS Security Team needs to come up with an overall communication plan for the wider community.
|
||||
This Disclosure process should begin after the Team has developed a fix or mitigation
|
||||
so that a realistic timeline can be communicated to users.
|
||||
|
||||
**Disclosure of Forthcoming Fix to Users** (Completed within 1-7 days of Disclosure)
|
||||
|
||||
- The Fix Lead will create a github issue in CoreDNS project to inform users that a security vulnerability
|
||||
has been disclosed and that a fix will be made available, with an estimation of the Release Date.
|
||||
has been disclosed and that a fix will be made available, with an estimation of the Release Date.
|
||||
It will include any mitigating steps users can take until a fix is available.
|
||||
|
||||
The communication to users should be actionable.
|
||||
|
@ -104,7 +104,7 @@ They should know when to block time to apply patches, understand exact mitigatio
|
|||
**Optional Fix Disclosure to Private Distributors List** (Completed within 1-14 days of Disclosure):
|
||||
|
||||
- The Fix Lead will make a determination with the help of the Fix Team if an issue is critical enough to require early disclosure to distributors.
|
||||
Generally this Private Distributor Disclosure process should be reserved for remotely exploitable or privilege escalation issues.
|
||||
Generally this Private Distributor Disclosure process should be reserved for remotely exploitable or privilege escalation issues.
|
||||
Otherwise, this process can be skipped.
|
||||
- The Fix Lead will email the patches to coredns-distributors-announce@lists.cncf.io so distributors can prepare their own release to be available to users on the day of the issue's announcement.
|
||||
Distributors should read about the [Private Distributor List](#private-distributor-list) to find out the requirements for being added to this list.
|
||||
|
@ -133,7 +133,7 @@ individuals to find out about security issues.
|
|||
|
||||
The information members receive on coredns-distributors-announce@lists.cncf.io must not be
|
||||
made public, shared, nor even hinted at anywhere beyond the need-to-know within
|
||||
your specific team except with the list's explicit approval.
|
||||
your specific team except with the list's explicit approval.
|
||||
This holds true until the public disclosure date/time that was agreed upon by the list.
|
||||
Members of the list and others may not use the information for anything other
|
||||
than getting the issue fixed for your respective distribution's users.
|
||||
|
@ -144,7 +144,7 @@ find out information on a need-to-know basis.
|
|||
|
||||
In the unfortunate event you share the information beyond what is allowed by
|
||||
this policy, you _must_ urgently inform the security@coredns.io
|
||||
mailing list of exactly what information leaked and to whom.
|
||||
mailing list of exactly what information leaked and to whom.
|
||||
|
||||
If you continue to leak information and break the policy outlined here, you
|
||||
will be removed from the list.
|
||||
|
|
|
@ -1,8 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
echo "** presubmit/$(basename $0)"
|
||||
|
||||
if grep -lr "golang.org/x/net/context" "$@"; then
|
||||
echo "** presubmit/$(basename $0): please use std lib's 'context' instead"
|
||||
exit 1
|
||||
fi
|
|
@ -1,7 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
echo "** presubmit/$(basename $0)"
|
||||
|
||||
if grep -r '[[:blank:]]$' "$@"; then
|
||||
echo "** presubmit/$(basename $0): please remove any trailing white space"
|
||||
fi
|
|
@ -4,7 +4,7 @@
|
|||
|
||||
## Synopsis
|
||||
|
||||
*coredns* **[-conf FILE]** **[-dns.port PORT}** **[OPTION]**...
|
||||
*coredns* **[-conf FILE]** **[-dns.port PORT}** **[OPTION]**...
|
||||
|
||||
## Description
|
||||
|
||||
|
|
|
@ -31,7 +31,7 @@ added. Documentation can be found in
|
|||
|
||||
* *proxy*: fix a bug when a connection hangs and never gets release (#467)
|
||||
* *proxy*: Fold *httpproxy* into it, which is now a normal proxy with a special `protocol`. For
|
||||
Monitoring an extra label was added: `proxy_proto` that shows the protocol used (`dns` or `https_google`).
|
||||
Monitoring an extra label was added: `proxy_proto` that shows the protocol used (`dns` or `https_google`).
|
||||
See the [proxy README.md](https://github.com/coredns/coredns/blob/master/plugin/proxy/README.md) for details.
|
||||
* *httpproxy*: removed because functionality is moved to *proxy*.
|
||||
* *kubernetes*: Now implements the full
|
||||
|
@ -43,7 +43,7 @@ added. Documentation can be found in
|
|||
* *kubernetes*: Simplified the configuration of reverse zones. Instead of listing the zones in the
|
||||
zone list, you can just add a list of CIDRs using the `cidrs` option.
|
||||
* *rewrite*: allow rewriting more bits of the incoming packet. This required some backward
|
||||
*incompatible* changes, e.g. a new **FIELD** keyword is now required. See the
|
||||
*incompatible* changes, e.g. a new **FIELD** keyword is now required. See the
|
||||
[rewrite README.md](https://github.com/coredns/coredns/blob/master/plugin/rewrite/README.md) for details.
|
||||
|
||||
|
||||
|
|
|
@ -10,9 +10,9 @@ author = "coredns"
|
|||
The CoreDNS team has released
|
||||
[CoreDNS-1.5.2](https://github.com/coredns/coredns/releases/tag/v1.5.2).
|
||||
|
||||
Small bugfixes and a change to Caddy's import path (mholt/caddy -> caddyserver/caddy). Doing
|
||||
a release helps plugins deal with the change better.
|
||||
|
||||
Small bugfixes and a change to Caddy's import path (mholt/caddy -> caddyserver/caddy). Doing
|
||||
a release helps plugins deal with the change better.
|
||||
|
||||
# Plugins
|
||||
|
||||
* For all plugins that use the `upstream` directive it use removed from the documentation; it's still accepted
|
||||
|
|
50
test/trailing_test.go
Normal file
50
test/trailing_test.go
Normal file
|
@ -0,0 +1,50 @@
|
|||
package test
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"unicode"
|
||||
)
|
||||
|
||||
func TestTrailingWhitespace(t *testing.T) {
|
||||
err := filepath.Walk("..", hasTrailingWhitespace)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func hasTrailingWhitespace(path string, info os.FileInfo, _ error) error {
|
||||
// Only handle regular files, skip files that are executable and skip file in the
|
||||
// root that start with a .
|
||||
if !info.Mode().IsRegular() {
|
||||
return nil
|
||||
}
|
||||
if info.Mode().Perm()&0111 != 0 {
|
||||
return nil
|
||||
}
|
||||
if strings.HasPrefix(path, "../.") {
|
||||
return nil
|
||||
}
|
||||
|
||||
println("looking at", path)
|
||||
file, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
scanner := bufio.NewScanner(file)
|
||||
for scanner.Scan() {
|
||||
text := scanner.Text()
|
||||
trimmed := strings.TrimRightFunc(text, unicode.IsSpace)
|
||||
if len(text) != len(trimmed) {
|
||||
return fmt.Errorf("file %q has trailing whitespace, text: %q", path, text)
|
||||
}
|
||||
}
|
||||
|
||||
return scanner.Err()
|
||||
}
|
Loading…
Add table
Reference in a new issue