-
Notifications
You must be signed in to change notification settings - Fork 2
feat(cloud-regions): honor custom templates and add --cluster-type filter #262
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 1 commit
Commits
Show all changes
17 commits
Select commit
Hold shift + click to select a range
009b6a0
feat(cloud-regions): honor custom templates and add --cluster-type fi…
JakeSCahill a7be9d4
fix(cloud-regions): keep --template and --output inside the repository
JakeSCahill 858b384
feat(cloud-regions): give templates the cluster type they were filter…
JakeSCahill d84f559
fix(cloud-regions): accept cluster types the source data adds
JakeSCahill 4e7285b
docs(cloud-regions): describe the context a custom template receives
JakeSCahill d725bb9
chore(release): bump version to 5.15.0
JakeSCahill 270fecb
docs(cloud-regions): say where the template path is contained
JakeSCahill c68bf9e
fix(cloud-regions): warn when the source data uses a cluster type we …
JakeSCahill c632105
fix(cloud-regions): sort zones so upstream reordering is not a docs c…
JakeSCahill 56f38c0
fix(cloud-regions): report a bad custom template as a compile error
JakeSCahill ec351ee
fix(cloud-regions): make --cluster-type name its own destination
JakeSCahill dd3403f
test(cloud-regions): close the CLI and MCP contract gap for --cluster…
JakeSCahill 66cc7f1
docs(mcp): correct the cloud-regions block in the CLI interface contract
JakeSCahill 2062d1d
test(cloud-regions): pin the cluster-type pass-through the unit tests…
JakeSCahill d93bf3a
Merge remote-tracking branch 'origin/main' into HEAD
JakeSCahill f55fa3b
fix(deps): take main's dependency set instead of carrying a stale pin…
JakeSCahill 97b40f5
Merge remote-tracking branch 'origin/main' into HEAD
JakeSCahill File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| const { processCloudRegions } = require('../../tools/cloud-regions/generate-cloud-regions'); | ||
|
|
||
| const sampleYaml = ` | ||
| regions: | ||
| - name: us-east-1 | ||
| cloudProvider: CLOUD_PROVIDER_AWS | ||
| zones: [use1-az1, use1-az2] | ||
| redpandaProductAvailability: | ||
| tier-1-aws: | ||
| redpandaProductName: tier-1-aws | ||
| clusterTypes: [CLUSTER_TYPE_BYOC, CLUSTER_TYPE_DEDICATED] | ||
| tier-2-aws: | ||
| redpandaProductName: tier-2-aws | ||
| clusterTypes: [CLUSTER_TYPE_BYOC] | ||
| tier-private-aws: | ||
| redpandaProductName: tier-private-aws | ||
| clusterTypes: [CLUSTER_TYPE_BYOC] | ||
| - name: eu-west-3 | ||
| cloudProvider: CLOUD_PROVIDER_AWS | ||
| zones: [euw3-az1] | ||
| redpandaProductAvailability: | ||
| tier-1-aws: | ||
| redpandaProductName: tier-1-aws | ||
| clusterTypes: [CLUSTER_TYPE_DEDICATED] | ||
| - name: us-west1 | ||
| cloudProvider: CLOUD_PROVIDER_GCP | ||
| zones: [us-west1-a] | ||
| redpandaProductAvailability: | ||
| tier-1-gcp: | ||
| redpandaProductName: tier-1-gcp | ||
| clusterTypes: [CLUSTER_TYPE_FMC] | ||
| products: | ||
| - name: tier-1-aws | ||
| isPublic: true | ||
| - name: tier-2-aws | ||
| isPublic: true | ||
| - name: tier-1-gcp | ||
| isPublic: true | ||
| - name: tier-private-aws | ||
| isPublic: false | ||
| `; | ||
|
|
||
| function regionNames(providers, providerName) { | ||
| const provider = providers.find((p) => p.name === providerName); | ||
| return provider ? provider.regions.map((r) => r.name) : []; | ||
| } | ||
|
|
||
| describe('processCloudRegions', () => { | ||
| it('includes all cluster types when no filter is given', () => { | ||
| const providers = processCloudRegions(sampleYaml); | ||
| expect(providers.map((p) => p.displayName)).toEqual(['Google Cloud Platform (GCP)', 'Amazon Web Services (AWS)']); | ||
| expect(regionNames(providers, 'AWS')).toEqual(['us-east-1', 'eu-west-3']); | ||
| expect(regionNames(providers, 'GCP')).toEqual(['us-west1']); | ||
| const usEast = providers.find((p) => p.name === 'AWS').regions[0]; | ||
| expect(usEast.tiers).toContain('tier-1-aws: BYOC, Dedicated'); | ||
| expect(usEast.tiers.join()).not.toContain('tier-private-aws'); | ||
| }); | ||
|
|
||
| it('filters regions and tiers by cluster type BYOC', () => { | ||
| const providers = processCloudRegions(sampleYaml, { clusterType: 'BYOC' }); | ||
| // eu-west-3 is Dedicated-only, so it must be dropped | ||
| expect(regionNames(providers, 'AWS')).toEqual(['us-east-1']); | ||
| // us-west1 is FMC-only, which maps to Dedicated | ||
| expect(regionNames(providers, 'GCP')).toEqual([]); | ||
| const usEast = providers.find((p) => p.name === 'AWS').regions[0]; | ||
| expect(usEast.tiers).toEqual(['tier-1-aws: BYOC', 'tier-2-aws: BYOC']); | ||
| }); | ||
|
|
||
| it('filters by cluster type Dedicated and maps FMC to Dedicated', () => { | ||
| const providers = processCloudRegions(sampleYaml, { clusterType: 'Dedicated' }); | ||
| expect(regionNames(providers, 'AWS')).toEqual(['us-east-1', 'eu-west-3']); | ||
| expect(regionNames(providers, 'GCP')).toEqual(['us-west1']); | ||
| const usEast = providers.find((p) => p.name === 'AWS').regions[0]; | ||
| expect(usEast.tiers).toEqual(['tier-1-aws: Dedicated']); | ||
| }); | ||
|
|
||
| it('accepts the cluster type case-insensitively', () => { | ||
| const providers = processCloudRegions(sampleYaml, { clusterType: 'byoc' }); | ||
| expect(regionNames(providers, 'AWS')).toEqual(['us-east-1']); | ||
| }); | ||
|
|
||
| it('throws on an unsupported cluster type', () => { | ||
| expect(() => processCloudRegions(sampleYaml, { clusterType: 'Serverless' })).toThrow(/Unsupported cluster type/); | ||
| }); | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: redpanda-data/docs-extensions-and-macros
Length of output: 29091
🏁 Script executed:
Repository: redpanda-data/docs-extensions-and-macros
Length of output: 50396
🏁 Script executed:
Repository: redpanda-data/docs-extensions-and-macros
Length of output: 21826
🏁 Script executed:
Repository: redpanda-data/docs-extensions-and-macros
Length of output: 18382
Restrict custom Handlebars templates for untrusted MCP callers.
The MCP tool forwards the caller-controlled
templatepath to the renderer, which reads the file. Dry-run mode returns the rendered content through MCP. Restrict templates to an approved directory or removetemplatefrom the MCP schema.🧰 Tools
🪛 ast-grep (0.45.1)
[warning] 36-36: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(templateFile, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename)
[error] 37-37: Server-Side Template Injection: a template string built from non-literal (potentially user-controlled) input is passed to a template engine (handlebars.compile / pug.compile / ejs.render / ejs.compile / _.template). An attacker who controls the template source can achieve arbitrary code execution. Compile templates only from trusted, hardcoded sources and pass user data through the template's context/data object instead, never into the template body itself.
Context: handlebars.compile(templateSrc)
Note: [CWE-1336] Improper Neutralization of Special Elements Used in a Template Engine.
(template-engine-ssti-javascript)
🤖 Prompt for AI Agents
Source: Linters/SAST tools