summon icon indicating copy to clipboard operation
summon copied to clipboard

fix: substitution variable format interferes with provider key resolution

Open doodlesbykumbi opened this issue 5 years ago • 1 comments

Currently if a substring in the "secret identifier" is perceived as a substitution variable AND is not declared then Summon throws an error. This has the disastrous effect of preventing providers that accept substrings prepended with $ from ever being run.

This issue follows from @jepperson2's comment at https://github.com/cyberark/summon-aws-secrets/issues/6#issuecomment-470661844

For example, a secrets.yml like this one fails:

MY_SECRET1: !var fakeSecret#$temp
MY_SECRET2: !var fakeSecret##temp
MY_SECRET3: !var fakeSecret#temp#
MY_SECRET4: !var fakeSecret#te#mp

Because MY_SECRET1 has a '$' in it, it is being parsed as though a corresponding -D temp=... should be passed to the summon command. The error I'm getting is from here: https://github.com/cyberark/summon/blob/master/secretsyml/secretsyml.go#L192

doodlesbykumbi avatar Mar 09 '19 06:03 doodlesbykumbi

Proposal

When the substitution variable has been declared!

$ summon \
 -p /bin/echo \
 -D temp=some_value \
 --yaml 'MY_SECRET1: fakeSecret#$temp' \
 printenv MY_SECRET1
fakeSecret#some_value

Since Summon requires explicit declaration of substitution variables via CLI flags (see above), if there is no declaration then a substring starting with $ isn't a substitution variable.

Current

$ summon \
 -p /bin/echo \
 --yaml 'MY_SECRET1: fakeSecret#$temp' \
 printenv MY_SECRET1
Variable temp not declared!

Proposal

$ summon \
 -p /bin/echo \
 --yaml 'MY_SECRET1: fakeSecret#$temp' \
 printenv MY_SECRET1
fakeSecret#$temp

doodlesbykumbi avatar Mar 09 '19 06:03 doodlesbykumbi