fix: Helm YAML Injection

[dennisvankekem]

No description provided.

[Copilot]

Pull request overview

This PR tightens input validation for Kubernetes NetworkPolicy selector labels to mitigate Helm/YAML injection risks by constraining label name/value fields to Kubernetes-compatible regex patterns and extending test coverage around those constraints.

Changes:

• Add kubernetesLabelName and kubernetesLabelValue regex definitions (max 63 chars) to the shared OpenAPI definitions.
• Update the netpol OpenAPI schema to use these new definitions for toLabelName/toLabelValue and fromLabelName/fromLabelValue.
• Extend unit and API authz tests to cover valid/invalid Kubernetes label names/values and guard against regex ReDoS.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/openapi/definitions.yaml	Introduces reusable regex definitions for Kubernetes label name/value.
src/openapi/netpol.yaml	Applies the new label name/value definitions to netpol selector fields via $ref.
src/patterns.test.ts	Adds ReDoS cases and validity tests for the new label patterns.
src/api-v2.authz.test.ts	Adds API-level validation tests ensuring invalid label values are rejected.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/api-v2.authz.test.ts:1426

• This test is redundant with the parameterized it.each([...])('rejects invalid label value %p', ...) immediately below (which already includes foo\nbar). Keeping both adds noise and extra runtime without increasing coverage.

      test('rejects multiline network policy label values', async () => {
        const netpol = createIngressAllowOnlyNetpol('foo\nbar')

        const response = await agent
          .post('/v2/teams/team1/netpols')

src/api-v2.authz.test.ts:1399

• The schema change also constrains toLabelName/fromLabelName via kubernetesLabelName, but the endpoint tests here only assert validation behavior for label values. Add at least one negative test that sets toLabelName or fromLabelName to an invalid value (e.g. empty string or multiline) and expects 400, so the new validation is exercised end-to-end.

This issue also appears on line 1422 of the same file.

          ingress: {
            mode: 'AllowOnly',
            toLabelName: 'app',
            toLabelValue,
            allow: [
              {
                fromNamespace: 'team1',
                fromLabelName: 'app',

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

src/openapi/definitions.yaml:849

• kubernetesLabelName currently only matches the 63-char name segment and does not allow the optional DNS prefix + '/' used by common Kubernetes label keys (e.g. app.kubernetes.io/name). If toLabelName/fromLabelName are intended to accept full label keys, this pattern (and maxLength) will reject valid Kubernetes selectors and could be a breaking change.

kubernetesLabelName:
  type: string
  maxLength: 63
  pattern: '^(?![\s\S]*[\r\n])[A-Za-z0-9](?:[-._A-Za-z0-9]{0,61}[A-Za-z0-9])?$'

src/openapi/netpol.yaml:58

• This schema is OpenAPI 3.0 (src/openapi/api.yaml sets openapi: '3.0.0'). In OAS 3.0, sibling keywords next to $ref (like title, description, example) are ignored by many tools, so the metadata here may no longer show up in generated docs/clients after switching from type: string to $ref. Consider using allOf: [ { $ref: ... } ] (or moving the metadata into the referenced definition) to preserve these fields.

        toLabelName:
          $ref: 'definitions.yaml#/kubernetesLabelName'
          title: Selector label name
          description: 'The name of the Pod selector label.'
          example: app

[CasLubbers]

Validated on cluster and could not add a malicious payload through the netpols api