[release-6.6] LOG-9752: prevent TOML literal-multiline injection in generated collector config by openshift-cherrypick-robot · Pull Request #3518 · openshift/cluster-logging-operator

openshift-cherrypick-robot · 2026-09-30T19:29:42Z

This is an automated cherry-pick of #3492

/assign jcantrill

…config go-toml v1 emits struct fields tagged `multiline:"true" literal:"true"` (transforms.Remap.Source and transforms.Filter.Condition) verbatim between ''' delimiters with no escaping. A value derived from an untrusted ClusterLogForwarder spec that contains the ''' terminator breaks out of the TOML string and injects arbitrary TOML into the collector configuration. FIND-001 (LOG-9704) fixed only the drop-filter sink. This closes the remaining sinks that share the same encoder gap: - Structural guard (internal/utils/toml): toml.Marshal now walks the config and rejects any literal-multiline field whose value contains the terminator. This is the single choke point every VRL sink funnels through, so it covers output user-templates, prune/drop FieldPath, kubeAPIAudit wildcards, and any future literal sink. A malformed config is never rendered; the reconciler reports the error instead of deploying a crash-looping collector. - Defense-in-depth admission validation, so a bad spec is rejected with a clear status condition before generation: - outputs: cloudwatch.groupName, elasticsearch.index, googleCloudLogging.logId, kafka.topic, loki.tenantKey, splunk.index - filters: prune/drop FieldPath quoted segments - filters: kubeAPIAudit rule strings (users, groups, verbs, namespaces, nonResourceURLs, resources) which previously had no controller validation A shared common.ValidateTOMLLiteralSafe helper backs all three. ref: LOG-9752 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Extend admission-time TOML literal-multiline injection guards to every user-controlled string that reaches a Vector remap source: - filters: validate openshiftLabels keys/values; validate kubeAPIAudit rule Level, rule OmitStages, and filter-level OmitStages - outputs: validate splunk source/sourceType/payloadKey, s3 keyPrefix, and syslog facility/severity/appName/procId/msgId/payloadKey Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Splunk IndexedFields flow through GenerateQuotedPathSegmentArrayStr into the Vector remap source; %q quoting escapes quotes and newlines but not the literal-multiline terminator, so validate each entry at admission time. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

openshift-ci-robot · 2026-09-30T19:29:45Z

@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: LOG-9752

Details

In response to this:

This is an automated cherry-pick of #3492

/assign jcantrill

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-30T19:29:49Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/cluster-logging-operator/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 801455f8-5d48-418f-857b-82d987e1a560

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

jcantrill · 2026-09-30T19:30:28Z

/label tide/merge-method-squash

jcantrill · 2026-09-30T19:30:53Z

/approve
/lgtm

jcantrill · 2026-09-30T19:31:14Z

/label verified

openshift-ci · 2026-09-30T19:31:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill, openshift-cherrypick-robot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vparfonov · 2026-10-01T13:57:23Z

/retest-required

vparfonov · 2026-10-05T11:57:31Z

/retest-required

vparfonov · 2026-10-05T13:59:30Z

/retest-required

jcantrill · 2026-10-05T21:11:26Z

/retest

jcantrill · 2026-10-05T21:11:39Z

/label verified

openshift-merge-bot · 2026-10-05T23:04:41Z

/retest-required

Remaining retests: 0 against base HEAD 4adb073 and 2 for PR HEAD 86f1e41 in total

vparfonov · 2026-10-06T09:56:52Z

/retest-required

jcantrill · 2026-10-07T20:24:37Z

/retest-required

jcantrill · 2026-10-09T20:35:10Z

/retest

jcantrill · 2026-10-12T13:02:48Z

/retest-required

openshift-merge-bot · 2026-10-13T16:06:12Z

/retest-required

Remaining retests: 0 against base HEAD e8581c0 and 1 for PR HEAD 86f1e41 in total

jcantrill · 2026-10-13T18:39:13Z

/retest-required

openshift-ci · 2026-10-13T21:29:24Z

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-target	`86f1e41`	link	true	`/test e2e-target`
ci/prow/functional-target	`86f1e41`	link	true	`/test functional-target`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jcantrill and others added 3 commits September 30, 2026 19:29

openshift-cherrypick-robot mentioned this pull request Sep 30, 2026

LOG-9752: prevent TOML literal-multiline injection in generated collector config #3492

Merged

openshift-cherrypick-robot assigned jcantrill Sep 30, 2026

openshift-ci Bot requested review from Clee2691 and alanconway September 30, 2026 19:30

openshift-ci Bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Sep 30, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 30, 2026

openshift-ci Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. verified Signifies that the PR passed pre-merge verification criteria labels Sep 30, 2026

jcantrill added release/6.6 and removed verified Signifies that the PR passed pre-merge verification criteria labels Sep 30, 2026

openshift-ci Bot added the verified Signifies that the PR passed pre-merge verification criteria label Oct 5, 2026

Conversation

openshift-cherrypick-robot commented Sep 30, 2026

Uh oh!

openshift-ci-robot commented Sep 30, 2026

Uh oh!

coderabbitai Bot commented Sep 30, 2026

Review skipped

Uh oh!

jcantrill commented Sep 30, 2026

Uh oh!

jcantrill commented Sep 30, 2026

Uh oh!

jcantrill commented Sep 30, 2026

Uh oh!

openshift-ci Bot commented Sep 30, 2026

Uh oh!

vparfonov commented Oct 1, 2026

Uh oh!

vparfonov commented Oct 5, 2026

Uh oh!

vparfonov commented Oct 5, 2026

Uh oh!

jcantrill commented Oct 5, 2026

Uh oh!

jcantrill commented Oct 5, 2026

Uh oh!

openshift-merge-bot Bot commented Oct 5, 2026

Uh oh!

vparfonov commented Oct 6, 2026

Uh oh!

jcantrill commented Oct 7, 2026

Uh oh!

jcantrill commented Oct 9, 2026

Uh oh!

jcantrill commented Oct 12, 2026

Uh oh!

openshift-merge-bot Bot commented Oct 13, 2026

Uh oh!

jcantrill commented Oct 13, 2026

Uh oh!

openshift-ci Bot commented Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants