Repository navigation
docs(security): the Iceberg sink catalogAuth checks and the Debezium Server's dotenv names - #199
Merged
Merged
Conversation
…Server's dotenv names
Three forge-cli fixes on main, not yet in a release:
- forge-cli #828: the sink's catalogAuth host check refuses the cloud
metadata addresses, as the other internal-endpoint checks do;
- forge-cli #830: with catalogAuth, text the sink expands later (${, a
leading env:, a control character) is refused in a catalog URL and in
the override values Iceberg reads;
- forge-cli #833: a project dotenv file cannot set the embedded Debezium
Server's configuration, its JVM options or its launcher's settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents three forge-cli security fixes that are on
main, not yet in a release. Each changed sentence carries the house marker*On forge-climain, not yet in a release ([forge-cli #N](…)).*.docs/advanced/source-aligned-acquisition.mdanddocs/advanced/network-safety.md. The Iceberg sink'scatalogAuthhost check now refuses the cloud metadata addresses even when listed, like the orchestrator guard, the OpenLineage emitter and the managed Flink host check. The sentence saying it "refuses link-local and unspecified addresses only" is updated. The169.254.169.254refusal example is the text the CLI now prints.docs/advanced/source-aligned-acquisition.md. A new "Override text" rule. WithcatalogAuth, a catalog URL that holds${, starts withenv:or holds a control character is refused wherever it is set, and so is such text in the override values Iceberg reads. Kafka-side keys keep their config providers.docs/advanced/project-dotenv-trust.md. A project dotenv file can no longer set the embedded Debezium Server's configuration (DEBEZIUM_*,QUARKUS_*,SMALLRYE_*,MP_CONFIG_*, profile forms included), its JVM options and binary (JDK_JAVA_OPTIONS,JAVA_OPTS,JAVA_HOME), or its launcher's settings.Checks
data-product-forge==0.27.0from PyPI (Python 3.11), all exit 0:check_cli_docs.pycheck_providers.pycheck_cli_docs.py --markers-onlygen_contract_reference.py --checknpm ci && npm run docs:build && node scripts/check-dist-links.mjs: exit 0.169.254.169.254example output was captured from forge-cli main after #828.