nebula: Eliminate injection classes by replacing templates with typed struct marshalling (follow-up to GHSA-7hp6)

Vulnerability Overview Vulnerability Name: configgen: marshal agent config via yaml.v3 typed struct (follow-up to GHSA-7hp6) #126 Vulnerability ID: #126 Status: Closed Created: May 20, 2023 Background: This issue is a follow-up to GHSA-7hp6, aiming to eliminate the entire class of injection vulnerabilities by replacing the text/template-based agent config generator with typed struct marshalling. Scope Affected File: Affected Function: Scope: Any fields added in the future (or any changes to existing validators) could potentially reopen the injection class. Remediation Remediation Details: Replaced with marshalling using the typed Go struct. Specific Steps: - Added new file , containing the typed struct and a reimplementation using the generator. - Removed , , and . - Updated and golden-file tests to assert equivalence in exact template output (YAML, key ordering may differ due to yaml.v3) or to assert by parsing and comparing rather than byte-equality. - The Mobile bundle path ( ) uses the same and requires no API changes. Acceptance Criteria All existing tests pass. Shape equivalence review of golden config output for representative hosts (lighthouse + relay + MTU + UnsafeRoutes + inline-PEM). Confirmation that values containing characters such as , , , , are correctly round-tripped into safely quoted scalars, even if the validator is bypassed (defense-in-depth assertion). Out of Scope Changes to validators (already addressed in GHSA-7hp6). Changes to the on-disk config format (i.e., ). Changes to agent-side parsing. Related Code Additional Information Contributors: jaeuv Labels: None Type: None Project: None Milestone: None Relationships: None Development: feat(configgen): yaml v3 typed-struct config marshal (closes #126) forgeek/nebula-mesh Version: v0.12.2 Comments ak2k: Referenced pull request yaml v3 typed-struct config marshal (closes #126) #130 joeuv: Added two commits referencing this issue and closed it as completed in #130 GoVulnBot: Referenced potential Go vulnerability in github.com/jaeuv/nebula-mesh: GHSA-7hp6-g3qp-3pc3 Summary This vulnerability was addressed by replacing the text/template-based agent config generator with typed struct marshalling, thereby eliminating the entire class of injection vulnerabilities and ensuring that fields added in the future do not reopen the injection class. The remediation included adding new files, removing old code, and updating tests to ensure all existing tests pass, along with conducting a shape equivalence review of the golden config output for representative hosts.

Goal Reached Thanks to every supporter — we hit 100%!

nebula: Eliminate injection classes by replacing templates with typed struct marshalling (follow-up to GHSA-7hp6)

More from this source