Repository: istio/istio
File: pilot/pkg/model/authorization.go (Go)

Code before:
// ListAuthorizationPolicies returns authorization policies applied to the workload in the given namespace.
func (policy *AuthorizationPolicies) ListAuthorizationPolicies(selectionOpts WorkloadSelectionOpts) AuthorizationPoliciesResult {
	configs := AuthorizationPoliciesResult{}
	if policy == nil {
		return configs
	}
	rootNamespace := policy.RootNamespace
	namespace := selectionOpts.Namespace
	workloadLabels := selectionOpts.WorkloadLabels
	var lookupInNamespaces []string

	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{rootNamespace, namespace}
	} else {
		lookupInNamespaces = []string{namespace}
	}

	for _, ns := range lookupInNamespaces {
		for _, config := range policy.NamespaceToPolicies[ns] {
			spec := config.Spec
			var selector labels.Instance // NOTE: nil/empty selector matches all workloads
			switch getPolicyMatcher(gvk.AuthorizationPolicy, config.Name, selectionOpts, spec) {
			case policyMatchSelector:
				selector = spec.GetSelector().GetMatchLabels()
				if selector.SubsetOf(workloadLabels) {
					configs = updateAuthorizationPoliciesResult(configs, config)
				}
			case policyMatchDirect:
				configs = updateAuthorizationPoliciesResult(configs, config)
				continue
			case policyMatchIgnore:
				continue
			}
		}
	}

	return configs
}

func updateAuthorizationPoliciesResult(configs AuthorizationPoliciesResult, config AuthorizationPolicy) AuthorizationPoliciesResult {
	log.Infof("applying authorization policy %s.%s",
		config.Namespace, config.Name)
	switch config.Spec.GetAction() {
	case authpb.AuthorizationPolicy_ALLOW:
		configs.Allow = append(configs.Allow, config)
	case authpb.AuthorizationPolicy_DENY:
		configs.Deny = append(configs.Deny, config)
	case authpb.AuthorizationPolicy_AUDIT:
		configs.Audit = append(configs.Audit, config)

Review comment (security):
```suggestion
			switch getPolicyMatcher(gvk.AuthorizationPolicy, config.Name, selectionOpts, spec) {
			case policyMatchSelector:
				selector := spec.GetSelector().GetMatchLabels()
```

Code after:
// ListAuthorizationPolicies returns authorization policies applied to the workload in the given namespace.
func (policy *AuthorizationPolicies) ListAuthorizationPolicies(selectionOpts WorkloadSelectionOpts) AuthorizationPoliciesResult {
	configs := AuthorizationPoliciesResult{}
	if policy == nil {
		return configs
	}
	rootNamespace := policy.RootNamespace
	namespace := selectionOpts.Namespace
	workloadLabels := selectionOpts.WorkloadLabels
	var lookupInNamespaces []string

	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{rootNamespace, namespace}
	} else {
		lookupInNamespaces = []string{namespace}
	}

	for _, ns := range lookupInNamespaces {
		for _, config := range policy.NamespaceToPolicies[ns] {
			spec := config.Spec
			switch getPolicyMatcher(gvk.AuthorizationPolicy, config.Name, selectionOpts, spec) {
			case policyMatchSelector:
				selector := labels.Instance(spec.GetSelector().GetMatchLabels())
				if selector.SubsetOf(workloadLabels) {
					configs = updateAuthorizationPoliciesResult(configs, config)
				}
			case policyMatchDirect:
				configs = updateAuthorizationPoliciesResult(configs, config)
			}
		}
	}

	return configs
}

func updateAuthorizationPoliciesResult(configs AuthorizationPoliciesResult, config AuthorizationPolicy) AuthorizationPoliciesResult {
	log.Infof("applying authorization policy %s.%s",
		config.Namespace, config.Name)
	switch config.Spec.GetAction() {
	case authpb.AuthorizationPolicy_ALLOW:
		configs.Allow = append(configs.Allow, config)
	case authpb.AuthorizationPolicy_DENY:
		configs.Deny = append(configs.Deny, config)
	case authpb.AuthorizationPolicy_AUDIT:
		configs.Audit = append(configs.Audit, config)
	case authpb.AuthorizationPolicy_CUSTOM:
		configs.Custom = append(configs.Custom, config)
	default:
		log.Errorf("ignored authorization policy %s.%s with unsupported action: %s",