STRLCPY/CVE-2023-22480_KubeOperator

■ ■ ■ ■ ■ ■

migration/126_alter_registry_user.up.sql

1	+	ALTER TABLE `ko`.`ko_system_registry` ADD COLUMN `nexus_user` VARCHAR(255) NULL AFTER `registry_hosted_port`;
2	+
3	+	UPDATE `ko`.`ko_system_registry` SET `nexus_user` = "admin";

■ ■ ■ ■ ■ ■ ■

pkg/controller/system_setting.go

		skipped 297 lines
298	298		return err
299	299		}
300	300
301		-	if err := nexus.CheckConn(req.Username, req.Password, fmt.Sprintf("%s://%s:%d", req.Protocol, req.Hostname, req.RepoPort)); err != nil {
	301	+	if err := nexus.CheckConn(req.NexusUser, req.NexusPassword, fmt.Sprintf("%s://%s:%d", req.Protocol, req.Hostname, req.RepoPort)); err != nil {
302	302		return err
303	303		}
304	304		return nil
	305	+	}
	306	+
	307	+	// Change Nexus Password
	308	+	// @Tags SystemSetting
	309	+	// @Summary Change user password
	310	+	// @Description 更新 Nexus 密码
	311	+	// @Accept json
	312	+	// @Produce json
	313	+	// @Param request body dto.RepoChangePassword true "request"
	314	+	// @Success 200
	315	+	// @Security ApiKeyAuth
	316	+	// @Router /settings/registry/change/password [post]
	317	+	func (s *SystemSettingController) PostRegistryChangePassword() error {
	318	+	var req dto.RepoChangePassword
	319	+	err := s.Ctx.ReadJSON(&req)
	320	+	if err != nil {
	321	+	return err
	322	+	}
	323	+	validate := validator.New()
	324	+	err = validate.Struct(req)
	325	+	if err != nil {
	326	+	return err
	327	+	}
	328	+	err = s.SystemSettingService.ChangePassword(req)
	329	+	if err != nil {
	330	+	return err
	331	+	}
	332	+
	333	+	operator := s.Ctx.Values().GetString("operator")
	334	+	go kolog.Save(operator, constant.UPDATE_NEXUS_PASSWORD, "-")
	335	+
	336	+	return err
305	337		}
306	338
307	339		// Delete Registry
		skipped 13 lines

■ ■ ■ ■ ■ ■

pkg/dto/system_registry.go

		skipped 8 lines
9	9		}
10	10
11	11		type SystemRegistryCreate struct {
12		-	model.SystemRegistry
13	12		Hostname string `json:"hostname" validate:"required"`
14	13		Protocol string `json:"protocol" validate:"required"`
15	14		Architecture string `json:"architecture" validate:"required"`
16	15		RepoPort int `json:"repoPort" validate:"required"`
17	16		RegistryPort int `json:"registryPort" validate:"required"`
18	17		RegistryHostedPort int `json:"registryHostedPort" validate:"required"`
	18	+	NexusUser string `json:"nexusUser" validate:"required"`
19	19		NexusPassword string `json:"nexusPassword" validate:"required"`
20	20		}
21	21
22	22		type SystemRegistryUpdate struct {
23		-	ID string `json:"id" validate:"required"`
24		-	Hostname string `json:"hostname" validate:"required"`
25		-	Protocol string `json:"protocol" validate:"required"`
26		-	RepoPort int `json:"repoPort" validate:"required"`
27		-	RegistryPort int `json:"registryPort" validate:"required"`
28		-	RegistryHostedPort int `json:"registryHostedPort" validate:"required"`
29		-	NexusPassword string `json:"nexusPassword" validate:"required"`
	23	+	ID string `json:"id"`
	24	+	Hostname string `json:"hostname"`
	25	+	Protocol string `json:"protocol"`
	26	+	Architecture string `json:"architecture"`
	27	+	RepoPort int `json:"repoPort"`
	28	+	RegistryPort int `json:"registryPort"`
	29	+	RegistryHostedPort int `json:"registryHostedPort"`
30	30		}
31	31
32	32		type SystemRegistryDelete struct {
		skipped 6 lines
39	39		}
40	40
41	41		type RepoChangePassword struct {
42		-	ID string `json:"id"`
43		-	Password string `json:"password"`
44		-	Original string `json:"original"`
	42	+	ID string `json:"id"`
	43	+	NexusUser string `json:"nexusUser"`
	44	+	NexusPassword string `json:"nexusPassword"`
45	45		}
46	46
47	47		type SystemRegistryConn struct {
48		-	Hostname string `json:"hostname" validate:"required"`
49		-	Protocol string `json:"protocol" validate:"required"`
50		-	RepoPort int `json:"repoPort" validate:"required"`
51		-	Username string `json:"username" validate:"required"`
52		-	Password string `json:"password" validate:"required"`
	48	+	Hostname string `json:"hostname" validate:"required"`
	49	+	Protocol string `json:"protocol" validate:"required"`
	50	+	RepoPort int `json:"repoPort" validate:"required"`
	51	+	NexusUser string `json:"nexusUser"`
	52	+	NexusPassword string `json:"nexusPassword"`
53	53		}
54	54

■ ■ ■ ■ ■ ■

pkg/model/system_registry.go

		skipped 13 lines
14	14		RepoPort int `json:"repoPort" gorm:"type:int(64)"`
15	15		RegistryPort int `json:"registryPort" gorm:"type:int(64)"`
16	16		RegistryHostedPort int `json:"registryHostedPort" gorm:"type:int(64)"`
17		-	NexusPassword string `json:"nexusPassword" gorm:"type:varchar(256);not null;"`
	17	+	NexusUser string `json:"nexusUser" gorm:"type:varchar(256);not null;"`
	18	+	NexusPassword string `json:"-" gorm:"type:varchar(256);not null;"`
18	19		}
19	20
20	21		func (s *SystemRegistry) BeforeCreate() (err error) {
		skipped 4 lines

■ ■ ■ ■ ■ ■

pkg/service/system_setting.go

		skipped 36 lines
37	37		UpdateRegistry(arch string, creation dto.SystemRegistryUpdate) (*dto.SystemRegistry, error)
38	38		BatchRegistry(op dto.SystemRegistryBatchOp) error
39	39		DeleteRegistry(id string) error
	40	+	ChangePassword(repo dto.RepoChangePassword) error
40	41		}
41	42
42	43		type systemSettingService struct {
		skipped 165 lines
208	209		RepoPort: r.RepoPort,
209	210		RegistryPort: r.RegistryPort,
210	211		RegistryHostedPort: r.RegistryHostedPort,
	212	+	NexusUser: r.NexusUser,
211	213		NexusPassword: pass,
212	214		},
213	215		}
		skipped 49 lines
263	265		return
264	266		}
265	267		if err := nexus.CheckConn(
266		-	"admin",
	268	+	repo.NexusUser,
267	269		pass,
268	270		fmt.Sprintf("%s://%s:%d", repo.Protocol, repo.Hostname, repo.RepoPort),
269	271		); err != nil {
		skipped 17 lines
287	289		return nil, err
288	290		}
289	291		systemRegistry := model.SystemRegistry{
290		-	ID: creation.ID,
291	292		Architecture: creation.Architecture,
292	293		Protocol: creation.Protocol,
293	294		Hostname: creation.Hostname,
294	295		RepoPort: creation.RepoPort,
295	296		RegistryPort: creation.RegistryPort,
296	297		RegistryHostedPort: creation.RegistryHostedPort,
	298	+	NexusUser: creation.NexusUser,
297	299		NexusPassword: password,
298	300		}
299	301		if err := s.systemRegistryRepo.Save(&systemRegistry); err != nil {
		skipped 3 lines
303	305		}
304	306
305	307		func (s systemSettingService) UpdateRegistry(arch string, creation dto.SystemRegistryUpdate) (*dto.SystemRegistry, error) {
306		-	password, err := encrypt.StringEncrypt(creation.NexusPassword)
307		-	if err != nil {
308		-	return nil, err
309		-	}
310	308		systemRegistry := model.SystemRegistry{
311	309		ID: creation.ID,
312	310		Architecture: arch,
		skipped 2 lines
315	313		RepoPort: creation.RepoPort,
316	314		RegistryPort: creation.RegistryPort,
317	315		RegistryHostedPort: creation.RegistryHostedPort,
318		-	NexusPassword: password,
319	316		}
320		-	if err := s.systemRegistryRepo.Save(&systemRegistry); err != nil {
	317	+	if err := db.DB.Model(&model.SystemRegistry{}).Update(&systemRegistry).Error; err != nil {
321	318		return nil, err
322	319		}
323	320		return &dto.SystemRegistry{SystemRegistry: systemRegistry}, nil
		skipped 23 lines
347	344		return nil
348	345		}
349	346
	347	+	func (u *systemSettingService) ChangePassword(ch dto.RepoChangePassword) error {
	348	+	password, err := encrypt.StringEncrypt(ch.NexusPassword)
	349	+	if err != nil {
	350	+	return err
	351	+	}
	352	+	if err := db.DB.Model(&model.SystemRegistry{}).Where("id = ?", ch.ID).
	353	+	Update(map[string]interface{}{"nexus_password": password, "nexus_user": ch.NexusUser}).Error; err != nil {
	354	+	return err
	355	+	}
	356	+	return nil
	357	+	}
	358	+

fix(registry): 仓库样式调整