Skip to content

Commit c7c45c9

Browse files
cindy52cindy52
authored
Remove curl|bash from dockerfile to address vulnerability issues (agones-dev#2438)
Files affected are: build/build-sdk-images/node/Dockerfile, build/build-sdk-images/restapi/Dockerfile, build/build-image/Dockerfile, examples/nodejs-simple/Dockerfile
1 parent 6c5e465 commit c7c45c9

13 files changed

Lines changed: 87 additions & 24 deletions

File tree

‎build/build-image/Dockerfile‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ FROM debian:buster
1818

1919
RUN apt-get update && \
2020
apt-get install -y build-essential gnupg curl git wget psmisc rsync make python bash-completion \
21-
zip nano jq graphviz gettext-base plantuml && \
21+
zip nano jq graphviz gettext-base plantuml software-properties-common && \
2222
apt-get clean
2323

2424
# install go
@@ -39,7 +39,7 @@ RUN wget -q https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.zip && un
3939
ENV PATH /usr/local/go/bin:/go/bin:/opt/google-cloud-sdk/bin:$PATH
4040

4141
# install go tooling for development, building and testing
42-
RUN go get -u golang.org/x/tools/cmd/goimports
42+
RUN go install golang.org/x/tools/cmd/goimports@latest
4343

4444
# RUN gcloud components update
4545
RUN gcloud components update && gcloud components install app-engine-go
@@ -68,7 +68,7 @@ RUN curl -L ${HELM_URL} > /tmp/helm.tar.gz \
6868
RUN echo "source <(helm completion bash)" >> /root/.bashrc
6969

7070
# install golang-ci linter
71-
RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $GOPATH/bin v1.42.1
71+
RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.43.0
7272

7373
#
7474
# \ \ / /__| |__ ___(_) |_ ___
@@ -84,8 +84,21 @@ RUN mkdir /tmp/hugo && \
8484
mv /tmp/hugo/hugo /usr/local/bin/ && \
8585
rm -r /tmp/hugo
8686

87-
RUN curl -sL https://deb.nodesource.com/setup_12.x | bash - && \
88-
apt-get install -y nodejs
87+
RUN add-apt-repository -y -r ppa:chris-lea/node.js
88+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list
89+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list.save
90+
91+
ARG KEYRING=/usr/share/keyrings/nodesource.gpg
92+
ARG VERSION=node_12.x
93+
94+
RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee "$KEYRING" >/dev/null
95+
RUN gpg --no-default-keyring --keyring "$KEYRING" --list-keys
96+
97+
ARG DISTRO="jessie"
98+
RUN echo "deb [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee /etc/apt/sources.list.d/nodesource.list
99+
RUN echo "deb-src [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee -a /etc/apt/sources.list.d/nodesource.list
100+
101+
RUN apt-get update && apt-get install -y nodejs
89102

90103
# install API reference docs generator
91104
RUN mkdir -p /go/src/github.com/ahmetb && \

‎build/build-sdk-images/node/Dockerfile‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,23 @@ FROM $BASE_IMAGE
1616

1717
## --allow-releaseinfo-change is a workaround for the new debian release
1818
## Can be removed when upgrading to bullseye
19-
RUN apt-get --allow-releaseinfo-change update && curl -sL https://deb.nodesource.com/setup_12.x | bash - && \
20-
apt-get install -y nodejs
19+
RUN apt-get --allow-releaseinfo-change update && apt-get install -y curl && apt-get install -y software-properties-common && \
20+
apt-get install -y gnupg && apt-get clean
21+
RUN add-apt-repository -y -r ppa:chris-lea/node.js
22+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list
23+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list.save
24+
25+
ARG KEYRING=/usr/share/keyrings/nodesource.gpg
26+
ARG VERSION=node_12.x
27+
28+
RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee "$KEYRING" >/dev/null
29+
RUN gpg --no-default-keyring --keyring "$KEYRING" --list-keys
30+
31+
ARG DISTRO="jessie"
32+
RUN echo "deb [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee /etc/apt/sources.list.d/nodesource.list
33+
RUN echo "deb-src [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee -a /etc/apt/sources.list.d/nodesource.list
34+
35+
RUN apt-get update && apt-get install -y nodejs
2136

2237
# Installing request is to address a bug with node-pre-gyp
2338
RUN npm install --unsafe-perm --global request@2.88.2 grpc-tools@1.8.1

‎build/build-sdk-images/restapi/Dockerfile‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ARG BASE_IMAGE=agones-build-sdk-base:latest
1515
FROM $BASE_IMAGE
1616

1717
RUN apt-get --allow-releaseinfo-change update && \
18-
apt-get install -y wget jq && \
18+
apt-get install -y wget jq software-properties-common gnupg && \
1919
apt-get clean
2020

2121
# install go
@@ -27,8 +27,21 @@ RUN wget -q https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz && \
2727
tar -xzf go${GO_VERSION}.linux-amd64.tar.gz && rm go${GO_VERSION}.linux-amd64.tar.gz && mkdir -p ${GOPATH}
2828

2929
RUN echo '§' && apt-get -qy update
30-
RUN curl -sL https://deb.nodesource.com/setup_12.x | bash - && \
31-
apt-get install -qq -y nodejs
30+
RUN add-apt-repository -y -r ppa:chris-lea/node.js
31+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list
32+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list.save
33+
34+
ARG KEYRING=/usr/share/keyrings/nodesource.gpg
35+
ARG VERSION=node_12.x
36+
37+
RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee "$KEYRING" >/dev/null
38+
RUN gpg --no-default-keyring --keyring "$KEYRING" --list-keys
39+
40+
ARG DISTRO="jessie"
41+
RUN echo "deb [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee /etc/apt/sources.list.d/nodesource.list
42+
RUN echo "deb-src [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee -a /etc/apt/sources.list.d/nodesource.list
43+
44+
RUN apt-get update && apt-get install -y nodejs
3245

3346
RUN apt-get install -qq -y openjdk-11-jre > /dev/null
3447

‎examples/nodejs-simple/Dockerfile‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,24 @@
1414

1515
FROM debian:buster
1616
RUN useradd -u 1000 -m server
17-
RUN apt-get update && apt-get install -y curl && apt-get clean
18-
RUN curl -sL https://deb.nodesource.com/setup_12.x | bash - && \
19-
apt-get install -y nodejs
17+
RUN apt-get update && apt-get install -y curl software-properties-common gnupg && \
18+
apt-get clean
19+
20+
RUN add-apt-repository -y -r ppa:chris-lea/node.js
21+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list
22+
RUN rm -f /etc/apt/sources.list.d/chris-lea-node_js-*.list.save
23+
24+
ARG KEYRING=/usr/share/keyrings/nodesource.gpg
25+
ARG VERSION=node_12.x
26+
27+
RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee "$KEYRING" >/dev/null
28+
RUN gpg --no-default-keyring --keyring "$KEYRING" --list-keys
29+
30+
ARG DISTRO="jessie"
31+
RUN echo "deb [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee /etc/apt/sources.list.d/nodesource.list
32+
RUN echo "deb-src [signed-by=$KEYRING] https://deb.nodesource.com/$VERSION $DISTRO main" | tee -a /etc/apt/sources.list.d/nodesource.list
33+
34+
RUN apt-get update && apt-get install -y nodejs
2035

2136
WORKDIR /home/server
2237

‎examples/nodejs-simple/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ REPOSITORY = gcr.io/agones-images
2828
# Directory that this Makefile is in.
2929
mkfile_path := $(abspath $(lastword $(MAKEFILE_LIST)))
3030
project_path := $(dir $(mkfile_path))
31-
server_tag = $(REPOSITORY)/nodejs-simple-server:0.5
31+
server_tag = $(REPOSITORY)/nodejs-simple-server:0.6
3232
root_path = $(realpath $(project_path)/../..)
3333

3434
# _____ _

‎examples/nodejs-simple/README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ $ make run
4242

4343
The example can also be run via docker:
4444
```
45-
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.5
45+
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.6
4646
```
4747
Or directly via npm:
4848
```
@@ -51,7 +51,7 @@ $ npm start
5151

5252
You will see the output like the following:
5353
```
54-
docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.5
54+
docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.6
5555
5656
> @ start /home/server/examples/nodejs-simple
5757
> node src/index.js
@@ -63,22 +63,22 @@ Connecting to the SDK server...
6363
To see help, pass `--help` as the argument (use the preferred command below, all are equivalent):
6464
```
6565
$ make args="--help" run
66-
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.5 --help
66+
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.6 --help
6767
$ npm start -- --help
6868
```
6969

7070
You can optionally specify how long the server will stay up once the basic tests are complete with the `--timeout` option.
7171
To do this pass arguments through, e.g. to increase the shutdown duration to 120 seconds:
7272
```
7373
$ make args="--timeout=120" run
74-
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.5 --timeout=120
74+
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.6 --timeout=120
7575
$ npm start -- --timeout=120
7676
```
7777

7878
To make run indefinitely use the special timeout value of 0:
7979
```
8080
$ make args="--timeout=0" run
81-
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.5 --timeout=0
81+
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.6 --timeout=0
8282
$ npm start -- --timeout=0
8383
```
8484

@@ -90,6 +90,6 @@ $ cd ../../build; make run-sdk-conformance-local TIMEOUT=120 FEATURE_GATES="Play
9090
Then enable the alpha suite:
9191
```
9292
$ make args="--alpha" run
93-
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.5 --alpha
93+
$ docker run --network=host gcr.io/agones-images/nodejs-simple-server:0.6 --alpha
9494
$ npm start -- --alpha
9595
```

‎examples/nodejs-simple/gameserver.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,5 @@ spec:
3232
spec:
3333
containers:
3434
- name: nodejs-simple
35-
image: gcr.io/agones-images/nodejs-simple-server:0.5
35+
image: gcr.io/agones-images/nodejs-simple-server:0.6
3636
# args: ["--timeout=0"] # Change the timeout here, if you like the nodejs server to run longer.

‎pkg/fleetautoscalers/fleetautoscalers_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,12 @@ func (t testServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
4949
res, err := ioutil.ReadAll(r.Body)
5050
if err != nil {
5151
http.Error(w, err.Error(), http.StatusInternalServerError)
52+
return
5253
}
5354
err = json.Unmarshal(res, &faRequest)
5455
if err != nil {
5556
http.Error(w, err.Error(), http.StatusInternalServerError)
57+
return
5658
}
5759

5860
// return different errors for tests
@@ -65,6 +67,7 @@ func (t testServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
6567
_, err = io.WriteString(w, "invalid data")
6668
if err != nil {
6769
http.Error(w, "Error writing json from /address", http.StatusInternalServerError)
70+
return
6871
}
6972
}
7073

@@ -88,11 +91,13 @@ func (t testServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
8891
result, err := json.Marshal(&review)
8992
if err != nil {
9093
http.Error(w, "Error marshaling json", http.StatusInternalServerError)
94+
return
9195
}
9296

9397
_, err = io.WriteString(w, string(result))
9498
if err != nil {
9599
http.Error(w, "Error writing json from /address", http.StatusInternalServerError)
100+
return
96101
}
97102
}
98103

‎pkg/util/apiserver/apiserver.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ func NewAPIServer(mux *http.ServeMux) *APIServer {
9898
if err != nil {
9999
s.logger.WithError(errors.WithStack(err)).Error("error return openapi")
100100
http.Error(w, err.Error(), http.StatusInternalServerError)
101+
return
101102
}
102103
})
103104

‎pkg/util/https/https.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ func ErrorHTTPHandler(logger *logrus.Entry, f ErrorHandlerFunc) http.HandlerFunc
5353
if err != nil {
5454
runtime.HandleError(LogRequest(logger, r), err)
5555
http.Error(w, err.Error(), http.StatusInternalServerError)
56+
return
5657
}
5758
}
5859
}

0 commit comments

Comments
 (0)