sharjeelyunus/github-issues-dataset huggingface dataset:
Repository: kubernetes
Issue: TOB-K8S-020: Kubectl can cause a local Out Of Memory error with a malicious Pod specification
Labels: kind/bug,area/security,sig/cli,lifecycle/frozen,wg/security-audit

This issue was reported in the [Kubernetes Security Audit Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Description**
When attempting to apply a Pod to the cluster, kubectl will read in the entire Pod spec in an attempt to perform validation. This results in the entire Pod spec being loaded into memory when loading from either an on-disk or remote resource. The latter is more dangerous because it is a commonly acceptable practice to pull a Pod spec from remote web server. A weaponized example of this has been produced leveraging a Python Flask server and kubectl in Figure 1 and 2, respectively.

```
from flask import Flask, Response

app = Flask(__name__)

@app.route('/')
def generate_large_response():
    return Response("A"* (500 * 1024 * 1024), mimetype="text/yaml")

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8000)
```
Figure 15.1: The malicious web server running on 172.31.6.71:8000

```
root@node1:/home/ubuntu# kubectl apply -f http://172.31.6.71:8000/
Killed
```
Figure 15.2: The killing of kubectl due to an OOM.

The area of code requiring full loading of the Pod spec is within the validation of annotation length, visible in Figure 3.
```
func ValidateAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	var totalSize int64
	for k, v := range annotations {
		...
		totalSize += (int64)(len(k)) + (int64)(len(v))
	}
	if totalSize > (int64)(totalAnnotationSizeLimitB) {
		allErrs = append(allErrs, field.TooLong(fldPath, "", totalAnnotationSizeLimitB))
	}
	return allErrs
}
```
Figure 15.3: The calculation checking if the totalSize of annotations are larger than the limit.

**Exploit Scenario**
Eve configures a malicious web server to send large responses on every request. Alice references a pod file on Eve’s web server through kubectl apply. Eve’s malicious web server returns a response that is too large for Alice’s machine to store in memory. Alice unknowingly causes an OOM on her machine running kubectl apply.

**Recommendation**
Avoid loading arbitrary data into memory regardless of size. Limit the size of a valid spec or inform the user when it consumes a substantial amount of memory, especially for specs that are fetched from remote endpoints.

**Anything else we need to know?**:

See #81146 for current status of all issues created from these findings.

The vendor gave this issue an ID of TOB-K8S-020 and it was finding 15 of the report.

The vendor considers this issue Medium Severity.

To view the original finding, begin on page 48 of the [Kubernetes Security Review Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Environment**:

- Kubernetes version: 1.13.4
Repository: kubernetes
Issue: TOB-K8S-029: Encryption recommendations not in accordance with best practices
Labels: kind/bug,area/security,kind/documentation,sig/storage,sig/auth,sig/docs,lifecycle/frozen,wg/security-audit,sig/security

This issue was reported in the [Kubernetes Security Audit Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Description**
The cryptographic recommendations in the official documentation are not accurate, and may lead users to make unsafe choices with their Kubernetes encryption configuration.

https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/

The default encryption option for users should be SecretBox. It is more secure and efficient than AES-CBC. Users should be encouraged to use KMS whenever possible. We believe these should be the only two options available to users. AES-GCM is secure, but as the docs point out, requires frequent key rotation to avoid nonce reuse attacks. 

Finally, AES-CBC is vulnerable to padding oracle attacks and should be deprecated. While Kubernetes doesn't lend itself to a padding oracle attack, AES-CBC being the recommended algorithm both spreads misconceptions about cryptographic security and promotes a strictly worse choice than SecretBox.

**Exploit Scenario**
Alice configures an EncryptionConfiguration following the Kubernetes official documentation. Due to the lack of correctness in regards to best practices, Alice is misled and uses the wrong encryption provider.

**Recommendation**
Short term, default to the use of the SecretBox provider.

Long term, revise the documentation regarding the available EncryptionConfiguration providers and ensure the documentation follows up-to-date best practices. The updated table included in Appendix G should be used as a replacement of the existing table. 

**Anything else we need to know?**:

See #81146 for current status of all issues created from these findings.

The vendor gave this issue an ID of TOB-K8S-029 and it was finding 19 of the report.

The vendor considers this issue Medium Severity.

To view the original finding, begin on page 57 of the [Kubernetes Security Review Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Environment**:

- Kubernetes version: 1.13.4
Repository: kubernetes
Issue: TOB-K8S-024: kubelet liveness probes can be used to enumerate host network
Labels: kind/bug,priority/backlog,area/security,sig/node,priority/important-longterm,lifecycle/frozen,wg/security-audit,triage/accepted

This issue was reported in the [Kubernetes Security Audit Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Description**
Kubernetes supports both readiness and liveness probes to detect when a Pod is operating correctly, and when to begin or stop directing traffic to a Pod. Three methods are available to facilitate these probes: command execution, HTTP, and TCP.

Using the HTTP and TCP probes, it is possible for an operator with limited access to the cluster (purely kubernetes-service related access) to enumerate the underlying host network. This is possible due to the scope in which these probes execute. Unlike the command execution probe, which will execute a command within the container, the TCP and HTTP probes execute from the context of the kubelet process. Thus, host networking interfaces are used, and the operator is now able to specify hosts which may not be available to Pods kubelet is managing.

The enumeration of the host network uses the container’s health and readiness to determine the status of the remote host. If the pod is killed and restarted due to a failed liveness probe, this indicates that the host is inaccessible. If the Pod successfully passes the liveness check and is presented as ready, the host is accessible. These two states create boolean states of accessible and inaccessible hosts to the underlying host running kubelet.

Additionally, an attacker can append headers through the Pod specification, which are interpreted by the Go HTTP library as authentication or additional request headers. This can allow an attacker to abuse liveness probes to access a wider-range of cluster resources. 

An example Pod file that can enumerate the host network is available in Appendix E.

**Exploit Scenario**
Alice configures a cluster which restricts communications between services on the cluster. Eve gains access to Alice’s cluster, and subsequently submits many Pods enumerating the host network in an attempt to gain information about Alice’s underlying host network.

**Recommendations**
Short term, restrict the kubelet in a way that prevents the kubelet from probing hosts it does not manage directly.

Long term, consider restricting probes to the container runtime, allowing liveness to be determined within the scope of the container-networking interface.

**Anything else we need to know?**:

See #81146 for current status of all issues created from these findings.

The vendor gave this issue an ID of TOB-K8S-024 and it was finding 21 of the report.

The vendor considers this issue Medium Severity.

To view the original finding, begin on page 60 of the [Kubernetes Security Review Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Environment**:

- Kubernetes version: 1.13.4
Repository: kubernetes
Issue: TOB-K8S-016: Unsafe JSON construction 
Labels: kind/bug,priority/important-soon,area/security,sig/api-machinery,sig/apps,help wanted,priority/important-longterm,lifecycle/frozen,wg/security-audit,triage/accepted

This issue was reported in the [Kubernetes Security Audit Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Description**
Kubernetes uses JavaScript Object Notation (JSON) and similarly structured data sources throughout the codebase. This supports inter-component communications, both internally and externally to the cluster. However, a number of locations within the codebase use unsafe methods of constructing JSON:

```
pkg/kubectl/cmd/taint/taint.go:218:				conflictTaint := fmt.Sprintf("{\"%s\":\"%s\"}", taintRemove.Key, taintRemove.Effect)

pkg/apis/rbac/helpers.go:109:	formatString := "{" + strings.Join(formatStringParts, ", ") + "}"
```
Figure 24.1: Examples of incorrect JSON and JSON-like construction

**Exploit Scenario**
Alice runs a Kubernetes cluster in her organization. Bob, a user in Alice’s organization, attempts to add an RBAC permission that he is not entitled to, which causes his entire RBAC construction to be written to logs, and potentially improperly consumed elsewhere.

**Recommendation**
Short term, use proper format-specific encoders for all areas of the application, regardless of where the information is used. 

Long term, unify the encoding method to ensure encoded values are validated before use, and that no portion of the application produces values with different validations.

**Anything else we need to know?**:

See #81146 for current status of all issues created from these findings.

The vendor gave this issue an ID of TOB-K8S-016 and it was finding 26 of the report.

The vendor considers this issue Low Severity.

To view the original finding, begin on page 69 of the [Kubernetes Security Review Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Environment**:

- Kubernetes version: 1.13.4
Repository: kubernetes
Issue: TOB-K8S-017: Use standard formats everywhere 
Labels: kind/bug,area/security,priority/awaiting-more-evidence,sig/auth,lifecycle/frozen,wg/security-audit

This issue was reported in the [Kubernetes Security Audit Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Description**
Kubernetes supports multiple backends for authentication and authorization, one of which is the Attribute-Based Access Control (ABAC) backend. This backend uses a format consisting of a single-line JSON object on each line.

```
for scanner.Scan() {
    i++ 
    p := &abac.Policy{}
    b := scanner.Bytes()

    // skip comment lines and blank lines
    trimmed := strings.TrimSpace(string(b))
    if len(trimmed) == 0 || strings.HasPrefix(trimmed, "#") {
       continue
    }   

    decodedObj, _, err := decoder.Decode(b, nil, nil)
    ...

```
Figure 31.1: A portion of NewFromFile - kubernetes-1.13.4/pkg/auth/authorizer/abac/abac.go

This line-delimited format leads to two main issues:


The format is prone to human error. Forcing JSON objects into a single line increases the difficulty of audits and the need for specialized tooling.
JSON objects are arbitrarily restricted to the size of Scanner tokens, or about 65k characters as of this report.

From a more systemic perspective, the use of various formats across the system (JSON, YAML, line-delimited, etc) leads to increased surface area for parsing vulnerabilities.

**Recommendation**
Short term, improve the semantics of ABAC configuration file parsing.

Long term, consider consolidating the use of multiple configuration file formats, and preventing arbitrary formats from being introduced into the system.

**Anything else we need to know?**:

See #81146 for current status of all issues created from these findings.

The vendor gave this issue an ID of TOB-K8S-017 and it was finding 32 of the report.

The vendor considers this issue Informational Severity.

To view the original finding, begin on page 78 of the [Kubernetes Security Review Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Environment**:

- Kubernetes version: 1.13.4
Repository: kubernetes
Issue: TOB-K8S-010: Hardcoded use of insecure gRPC transport
Labels: area/security,sig/storage,sig/node,kind/feature,sig/auth,priority/important-longterm,lifecycle/frozen,wg/security-audit,needs-triage

This issue was reported in the [Kubernetes Security Audit Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Description**
Kubernetes’ gRPC client uses a hardcoded WithInsecure() transport setting when dialing a remote:
```
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/grpc_service.go
64:	connection, err := grpc.Dial(addr, grpc.WithInsecure(), grpc.WithDefaultCallOptions(grpc.FailFast(false)), grpc.WithDialer(

pkg/kubelet/apis/podresources/client.go
39:	conn, err := grpc.DialContext(ctx, addr, grpc.WithInsecure(), grpc.WithDialer(dialer), grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxMsgSize)))

pkg/kubelet/util/pluginwatcher/plugin_watcher.go
431:	c, err := grpc.DialContext(ctx, unixSocketPath, grpc.WithInsecure(), grpc.WithBlock(),

pkg/kubelet/cm/devicemanager/device_plugin_stub.go
164:	conn, err := grpc.DialContext(ctx, kubeletEndpoint, grpc.WithInsecure(), grpc.WithBlock(),

pkg/kubelet/cm/devicemanager/endpoint.go
179:	c, err := grpc.DialContext(ctx, unixSocketPath, grpc.WithInsecure(), grpc.WithBlock(),

pkg/kubelet/remote/remote_runtime.go
51:	conn, err := grpc.DialContext(ctx, addr, grpc.WithInsecure(), grpc.WithDialer(dailer), grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxMsgSize)))

pkg/kubelet/remote/remote_image.go
50:	conn, err := grpc.DialContext(ctx, addr, grpc.WithInsecure(), grpc.WithDialer(dailer), grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxMsgSize)))

pkg/volume/csi/csi_client.go
709:		grpc.WithInsecure(),
```
Figure 33.1: The use of grpc.WithInsecure() when dialing a remote.

This could allow for man-in-the-middle attacks between the gRPC client and server.

**Exploit Scenario**
Alice has a Kubernetes node and remote gRPC server running on her network. Mallory has gained access to Alice’s network. Due to an insecure transport protocol in Alice’s network, Mallory can actively monitor the network traffic between the gRPC server and client.

**Recommendation**
Short term, add documentation that explains to end users the simplest mechanism for securing the gRPC.

Long term, consider adding a configuration option allowing the gRPC transport to be selected as either secure or insecure, where the secure transport is default.

**Anything else we need to know?**:

See #81146 for current status of all issues created from these findings.

The vendor gave this issue an ID of TOB-K8S-010 and it was finding 34 of the report.

The vendor considers this issue Informational Severity.

To view the original finding, begin on page 81 of the [Kubernetes Security Review Report](https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf)

**Environment**:

- Kubernetes version: 1.13.4
Repository: terminal
Issue: Feature Request Option to add profiles to the Windows Start Menu
Labels: Issue-Feature,Help Wanted,Area-UserInterface,Product-Terminal

Allow creating profile based entries in the Windows Start Menu

This will allow the user to launch the specific profile that they want without the need to open the default one

A button in the profile setting adds an entry in the Windows Start Menu with the icon profile and name, this entry launcher the windows terminal in this profile instead of the default one

### Maintainer Notes

**SPEC REQUIRED**

Specifier should build on work already done on #576, because I am betting that it'll be along the same path! (from @DHowett-MSFT)
Repository: rust
Issue: Adding a rustdoc option to do case-sensitive search
Labels: T-rustdoc,C-feature-request,A-rustdoc-search

It likes [`smartcase` mode in vim][1].

> If a pattern contains an uppercase letter, it is case sensitive, otherwise, it is not. 
> For example,  "The" would find only "The", while "the" would find "the" or "The" etc. 

[1]: https://vim.fandom.com/wiki/Searching#Case_sensitivity
Repository: TypeScript
Issue: Array of tuple literal not assignable to iterable of tuple with --lib es2015 -t es5
Labels: Needs Investigation

<!-- 🚨 STOP 🚨 𝗦𝗧𝗢𝗣 🚨 𝑺𝑻𝑶𝑷 🚨

Half of all issues filed here are duplicates, answered in the FAQ, or not appropriate for the bug tracker. Even if you think you've found a *bug*, please read the FAQ first, especially the Common "Bugs" That Aren't Bugs section!

Please help us by doing the following steps before logging an issue:
  * Search: https://github.com/Microsoft/TypeScript/search?type=Issues
  * Read the FAQ: https://github.com/Microsoft/TypeScript/wiki/FAQ

Please fill in the *entire* template below.
-->

<!-- Please try to reproduce the issue with `typescript@next`. It may have already been fixed. -->
**TypeScript Versions:**  3.5.1, 3.5.3 (currently `typescript@latest`), 3.6.0-beta (currently `typescript@beta`), 3.6.0-dev.20190808 (currently `typescript@next`)

<!-- Search terms you tried before logging this (so others can find this issue more easily) -->
**Search Terms:**

**Code**

```ts
// Works:
declare function foo<T>(i: Iterable<T>): T
const x = foo([1]); // infers a: number

// Fails:
declare function bar<T, U>(j: Iterable<[T, U]>): [T, U]
const y = bar([[1, 'a']]);
//             ^^^^^^^^
//             Argument of type '(string | number)[][]' is not assignable to
//             parameter of type 'Iterable<[string | number, string | number]>'.

// workaround:
declare function qux<T, U>(j: Array<[T, U]> | Iterable<[T, U]>): [T, U]
const z = qux([[1, 'a']]); // infers z: [number, string]
```

**Expected behavior:** variable `y` is inferred to be of type `[number, string]` and parameter `j` is inferred to be of type `Array<[number, string]>`

**Actual behavior:** `error TS2345: Argument of type '(string | number)[][]' is not assignable to parameter of type 'Iterable<[string | number, string | number]>'.`

**[Playground Link](https://www.typescriptlang.org/play/index.html?target=1#code/PTAEHUHsCcGsGcBcAoAJgUwMYBsCG11QAzAVwDtMAXAS0jOMkgB4AVAPgAprFQBJS9NFwAjbOlZsAlDxbJMdeJVAAPUAF4GkDgG0AjAF1JAblAhQ1MkUHxQuHmRIBbYYOTIzAMVzVsSNFjwCYnIqWnphfFYAGlAAVU4AKx5+QRExJm0WGNj9KR5M7P05BSUAT3VQCOgdPRiAclw6-UMTM0pSgAdCQWgYN3cwAHcYWHxIclQUDBx8QlIKGjpQAEcSZWi4xJ4AQWghUoysuNzQAB8+ASFRcQLjvNBbnOKyRVAALwrV5Rrdesbm4ymMAWKzQGxvfIOZyCGKKaAWADmRX6A1A6GUgg6AlQxF6jlA2GowgAdOh4AAmAAMugArMTqJc0uhiahiZQ-P4ZkEAG74UAAZVKzkg2B4guF2AAwiVoCQqDAjG4LJciLhMIRxcIRdKXpRZfLoKAAN7IUBm0wAKgtpvNoAtoG2oEc6EoAAtIDi3bglARKCRoC9QG7CBhVSRsEoGalKDAGIbcPRIMIElhKMTQJLcNgxDjhOVg6B4OhHAmaJgbJAiEHXegbeb7UQYABaSuFyje4voMhputmi3AXsEXCoOjYcpRoQx6A8eBCrXYRUAXyV3cEqvVF2jMAASmTw5QJMbeyOyOgeFqRegE4rbbzsCQz6AWEuVyq1YQUpOYIeTbbT8pKA4O8HwAfh4BNSmkTcv2gXd4H3CQb3NX1-TIECgKzUDwLISDkkZKc4IQ9gkLNN1ekGdD0DA2wcKgz9vR3PcI0Q5Bl2QZU13faCmR-XttE1EV6XwmB9A4OjhOgFi2I46B1w-RlrnoqdD3RAQyFQGwlO-dgj1tfi50EicGOgUTxNSRSJKk19OI3XZ9l421gCtbipztAc9IE7AhK3EyxLw8yxC0yTiNYoA)**

**Related Issues:** maybe #29311 ?
Repository: flutter
Issue: Toggle FlashLight when camera is open
Labels: c: new feature,a: quality,p: camera,package,team-ecosystem,P3,triaged-ecosystem

Need to toggle the flashlight during camera usage. (Used with ml_kit for text recognition and need the light for night usage).,Cannot ship my app without it.
Repository: deno
Issue: Redirect between stderr and stdout in `Deno.Command`
Labels: feat,public API,runtime

Ref https://github.com/denoland/deno/pull/1828#issuecomment-467719574

Rather than adding `Process::combinedOutput()`, I propose modelling `2>&1` in `RunOptions`.

Ref https://docs.python.org/3/library/subprocess.html#using-the-subprocess-module

```ts
export interface RunOptions {
  cmd: string[];
  cwd?: string;
  env?: {
    [key: string]: string;
  };
  stdout?: ProcessStdio | number;
  stderr?: ProcessStdio | number;
  stdin?: ProcessStdio | number;
}
```
->
```ts
export interface RunOptions {
  cmd: string[];
  cwd?: string;
  env?: {
    [key: string]: string;
  };
  stdout?: ProcessStdio | number;
  stderr?: ProcessStdio | "stdout" | number;
  stdin?: ProcessStdio | number;
}
```
Repository: go
Issue: go/types: Config.Check tries to create go.sum
Labels: NeedsInvestigation,modules,Tools

<!-- Please answer these questions before submitting your issue. Thanks! -->

### What version of Go are you using (`go version`)?

<pre>
$ go version
go version go1.12.7 linux/amd64
</pre>

### Does this issue reproduce with the latest release?
Yes


### What operating system and processor architecture are you using (`go env`)?

<details><summary><code>go env</code> Output</summary><br><pre>
$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/user/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/user/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build824852661=/tmp/go-build -gno-record-gcc-switches"
</pre></details>

### What did you do?
Using type `types.Config.Check()` on a file importing a package with `go.mod` but without `go.sum` causes an attempt to write the missing `go.sum` file. I realize not having `go.sum` is a mistake on the repo maintainer side, but there are projects like that out there and they're used. This in turns causes problems in applications that depend on the type-checker to find out some information about source code (e.g. ObjectBox code generator).

See https://github.com/vaind/go-type-checker-issues for a minimal example that shows the issue. Try running the following code as a non-root user on linux:

<pre>
$ git clone git@github.com:vaind/go-type-checker-issues.git
$ cd go-type-checker-issues/gosum
$ go test ./...
--- FAIL: TestGoSumPermissions (0.71s)
    gosum_test.go:39: gosum.go:5:4: could not import github.com/anacrolix/missinggo (type-checking package "github.com/anacrolix/missinggo" failed (/home/user/go/pkg/mod/github.com/anacrolix/missinggo@v0.0.0-20180725070939-60ef2fbf63df/strcase.go:6:2: could not import github.com/huandu/xstrings (go/build: importGo github.com/huandu/xstrings: exit status 1
        go: writing go.sum: open /home/user/go/pkg/mod/github.com/anacrolix/missinggo@v0.0.0-20180725070939-60ef2fbf63df/go.sum439740474.tmp: permission denied
        
        )))
FAIL
FAIL	github.com/vaind/go-type-checker-issues/gosum	0.711s

</pre>

Interestingly a combination of go get & go test works fine, but unfortunately that doesn't solve the problem if you have such imports in your own project...


### What did you expect to see?
I expect the type checker wouldn't try to create a missing `go.sum` file.