catalog

package

Go to main page

Versions in this module

v0

v0.33.0

Mar 1, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ var ErrNotFound = db.ErrNotFound

+ type ActionsOutputWriter struct

+ func NewActionsOutputWriter(blockAdapter block.Adapter) *ActionsOutputWriter

+ func (o *ActionsOutputWriter) OutputWrite(ctx context.Context, storageNamespace, name string, reader io.Reader, ...) error

+ type ActionsSource struct

+ func NewActionsSource(entryCatalog *EntryCatalog) *ActionsSource

+ func (s *ActionsSource) List(ctx context.Context, record graveler.HookRecord) ([]string, error)

+ func (s *ActionsSource) Load(ctx context.Context, record graveler.HookRecord, name string) ([]byte, error)

type Cataloger

+ GetEntryCatalog func() *EntryCatalog

type EntryCatalog

+ func (e *EntryCatalog) SetHooksHandler(hooks graveler.HooksHandler)

v0.32.1

Feb 17, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.32.0

Feb 17, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ type Actions interface

+ Run func(ctx context.Context, event actions.Event, deps actions.Deps) error

type Cataloger

+ CreateBareRepository func(ctx context.Context, repository string, storageNamespace string, ...) (*Repository, error)

+ GetMetaRange func(ctx context.Context, repositoryID, metaRangeID string) (graveler.MetaRangeInfo, error)

+ GetRange func(ctx context.Context, repositoryID, rangeID string) (graveler.RangeInfo, error)

+ LoadBranches func(ctx context.Context, repositoryID, branchesMetaRangeID string) error

+ LoadCommits func(ctx context.Context, repositoryID, commitsMetaRangeID string) error

+ LoadTags func(ctx context.Context, repositoryID, tagsMetaRangeID string) error

type Config

+ Actions Actions

type EntryCatalog

+ Actions Actions

+ func (e *EntryCatalog) CreateBareRepository(ctx context.Context, repositoryID graveler.RepositoryID, ...) (*graveler.Repository, error)

+ func (e *EntryCatalog) GetMetaRange(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.MetaRangeInfo, error)

+ func (e *EntryCatalog) GetRange(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.RangeInfo, error)

+ func (e *EntryCatalog) LoadBranches(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) LoadCommits(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) LoadTags(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) PostCommitHook(ctx context.Context, eventID uuid.UUID, ...) error

+ func (e *EntryCatalog) PostMergeHook(ctx context.Context, eventID uuid.UUID, ...) error

+ func (e *EntryCatalog) PreCommitHook(ctx context.Context, eventID uuid.UUID, ...) error

+ func (e *EntryCatalog) PreMergeHook(ctx context.Context, eventID uuid.UUID, ...) error

v0.31.2

Feb 10, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ type Config struct

+ Config *config.Config

+ DB db.Database

+ LockDB db.Database

type EntryCatalog

+ BlockAdapter block.Adapter

v0.31.1

Feb 9, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type Cataloger

+ DumpBranches func(ctx context.Context, repositoryID string) (string, error)

+ DumpCommits func(ctx context.Context, repositoryID string) (string, error)

+ DumpTags func(ctx context.Context, repositoryID string) (string, error)

type EntryCatalog

+ func (e *EntryCatalog) DumpBranches(ctx context.Context, repositoryID graveler.RepositoryID) (*graveler.MetaRangeID, error)

+ func (e *EntryCatalog) DumpCommits(ctx context.Context, repositoryID graveler.RepositoryID) (*graveler.MetaRangeID, error)

+ func (e *EntryCatalog) DumpTags(ctx context.Context, repositoryID graveler.RepositoryID) (*graveler.MetaRangeID, error)

v0.31.0

Feb 8, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const DiffLimitMax

+ const ListBranchesLimitMax

+ const ListEntriesLimitMax

+ const ListRepositoriesLimitMax

+ const ListTagsLimitMax

+ const MaxPathLength

+ const MetaRangeFSName

+ const RangeFSName

+ var ErrInvalidType = errors.New("invalid type")

+ var ErrRequiredValue = errors.New("required value")

+ var ErrUnknownDiffType = errors.New("unknown graveler difference type")

+ var File_catalog_proto protoreflect.FileDescriptor

+ var ValidatePathOptional = MakeValidateOptional(ValidatePath)

+ var ValidateTagIDOptional = MakeValidateOptional(ValidateTagID)

+ func EntryToValue(entry *Entry) (*graveler.Value, error)

+ func MustEntryToValue(entry *Entry) *graveler.Value

+ func NewEntryToValueIterator(it EntryIterator) *entryValueIterator

+ func NewValueToEntryIterator(it graveler.ValueIterator) *valueEntryIterator

+ func ValidateBranchID(v interface{}) error

+ func ValidateCommitID(v interface{}) error

+ func ValidateNonNegativeInt(v interface{}) error

+ func ValidateRef(v interface{}) error

+ func ValidateRepositoryID(v interface{}) error

+ func ValidateRequiredString(v interface{}) error

+ func ValidateTagID(v interface{}) error

type Cataloger

+ CreateTag func(ctx context.Context, repository, tagID string, ref string) (string, error)

+ DeleteTag func(ctx context.Context, repository, tagID string) error

+ GetTag func(ctx context.Context, repository, tagID string) (string, error)

+ ListTags func(ctx context.Context, repository string, limit int, after string) ([]*Tag, bool, error)

+ type DBEntry struct

+ Checksum string

+ CommonLevel bool

+ CreationDate time.Time

+ Expired bool

+ Metadata Metadata

+ Path string

+ PhysicalAddress string

+ Size int64

type Entry

+ Address string

+ ETag string

+ LastModified *timestamppb.Timestamp

+ func EntryFromCatalogEntry(entry DBEntry) *Entry

+ func ValueToEntry(value *graveler.Value) (*Entry, error)

+ func (*Entry) Descriptor() ([]byte, []int)

+ func (*Entry) ProtoMessage()

+ func (x *Entry) GetAddress() string

+ func (x *Entry) GetETag() string

+ func (x *Entry) GetLastModified() *timestamppb.Timestamp

+ func (x *Entry) GetMetadata() map[string]string

+ func (x *Entry) GetSize() int64

+ func (x *Entry) ProtoReflect() protoreflect.Message

+ func (x *Entry) Reset()

+ func (x *Entry) String() string

+ type EntryCatalog struct

+ Store Store

+ func NewEntryCatalog(cfg *config.Config, db db.Database) (*EntryCatalog, error)

+ func (e *EntryCatalog) AddCommit(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.CommitID, error)

+ func (e *EntryCatalog) AddCommitToBranchHead(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.CommitID, error)

+ func (e *EntryCatalog) Commit(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.CommitID, error)

+ func (e *EntryCatalog) Compare(ctx context.Context, repositoryID graveler.RepositoryID, from graveler.Ref, ...) (EntryDiffIterator, error)

+ func (e *EntryCatalog) CreateBranch(ctx context.Context, repositoryID graveler.RepositoryID, ...) (*graveler.Branch, error)

+ func (e *EntryCatalog) CreateRepository(ctx context.Context, repositoryID graveler.RepositoryID, ...) (*graveler.Repository, error)

+ func (e *EntryCatalog) CreateTag(ctx context.Context, repositoryID graveler.RepositoryID, tagID graveler.TagID, ...) error

+ func (e *EntryCatalog) DeleteBranch(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) DeleteEntry(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) DeleteRepository(ctx context.Context, repositoryID graveler.RepositoryID) error

+ func (e *EntryCatalog) DeleteTag(ctx context.Context, repositoryID graveler.RepositoryID, tagID graveler.TagID) error

+ func (e *EntryCatalog) Dereference(ctx context.Context, repositoryID graveler.RepositoryID, ref graveler.Ref) (graveler.CommitID, error)

+ func (e *EntryCatalog) Diff(ctx context.Context, repositoryID graveler.RepositoryID, ...) (EntryDiffIterator, error)

+ func (e *EntryCatalog) DiffUncommitted(ctx context.Context, repositoryID graveler.RepositoryID, ...) (EntryDiffIterator, error)

+ func (e *EntryCatalog) GetBranch(ctx context.Context, repositoryID graveler.RepositoryID, ...) (*graveler.Branch, error)

+ func (e *EntryCatalog) GetCommit(ctx context.Context, repositoryID graveler.RepositoryID, ...) (*graveler.Commit, error)

+ func (e *EntryCatalog) GetEntry(ctx context.Context, repositoryID graveler.RepositoryID, ref graveler.Ref, ...) (*Entry, error)

+ func (e *EntryCatalog) GetRepository(ctx context.Context, repositoryID graveler.RepositoryID) (*graveler.Repository, error)

+ func (e *EntryCatalog) GetTag(ctx context.Context, repositoryID graveler.RepositoryID, tagID graveler.TagID) (*graveler.CommitID, error)

+ func (e *EntryCatalog) ListBranches(ctx context.Context, repositoryID graveler.RepositoryID) (graveler.BranchIterator, error)

+ func (e *EntryCatalog) ListEntries(ctx context.Context, repositoryID graveler.RepositoryID, ref graveler.Ref, ...) (EntryListingIterator, error)

+ func (e *EntryCatalog) ListRepositories(ctx context.Context) (graveler.RepositoryIterator, error)

+ func (e *EntryCatalog) ListTags(ctx context.Context, repositoryID graveler.RepositoryID) (graveler.TagIterator, error)

+ func (e *EntryCatalog) Log(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.CommitIterator, error)

+ func (e *EntryCatalog) Merge(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.CommitID, graveler.DiffSummary, error)

+ func (e *EntryCatalog) Reset(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) ResetKey(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) ResetPrefix(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) Revert(ctx context.Context, repositoryID graveler.RepositoryID, ...) (graveler.CommitID, graveler.DiffSummary, error)

+ func (e *EntryCatalog) SetEntry(ctx context.Context, repositoryID graveler.RepositoryID, ...) error

+ func (e *EntryCatalog) UpdateBranch(ctx context.Context, repositoryID graveler.RepositoryID, ...) (*graveler.Branch, error)

+ func (e *EntryCatalog) WriteMetaRange(ctx context.Context, repositoryID graveler.RepositoryID, it EntryIterator) (*graveler.MetaRangeID, error)

+ type EntryDiff struct

+ Entry *Entry

+ Path Path

+ Type graveler.DiffType

+ type EntryDiffIterator interface

+ Close func()

+ Err func() error

+ Next func() bool

+ SeekGE func(id Path)

+ Value func() *EntryDiff

+ func NewEntryDiffIterator(it graveler.DiffIterator) EntryDiffIterator

+ type EntryIterator interface

+ Close func()

+ Err func() error

+ Next func() bool

+ SeekGE func(id Path)

+ Value func() *EntryRecord

+ func NewPrefixIterator(it EntryIterator, prefix Path) EntryIterator

+ type EntryListing struct

+ CommonPrefix bool

+ type EntryListingIterator interface

+ Close func()

+ Err func() error

+ Next func() bool

+ SeekGE func(id Path)

+ Value func() *EntryListing

+ func NewEntryListingIterator(it EntryIterator, prefix Path, delimiter Path) EntryListingIterator

+ type EntryRecord struct

+ Path Path

+ type Path string

+ func (id Path) String() string

+ type RevertParams struct

+ Committer string

+ ParentNumber int

+ Reference string

+ type Store interface

+ type Tag struct

+ CommitID string

+ ID string

+ type ValidateArg struct

+ Fn ValidateFunc

+ Name string

+ Value interface{}

type ValidateFunc

+ func MakeValidateOptional(fn ValidateFunc) ValidateFunc

v0.30.0

Jan 26, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type Cataloger

+ Revert func(ctx context.Context, repository, branch string, reference string, ...) error

type CommitLog

+ MetaRangeID string

v0.23.1

Jan 21, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

type Branch

+ Reference string

type Cataloger

+ Compare func(ctx context.Context, repository, leftReference string, rightReference string, ...) (Differences, bool, error)

v0.23.0

Jan 18, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.22.1

Jan 11, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.22.0

Jan 3, 2021 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.21.4

Dec 20, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.21.3

Dec 20, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.21.2

Dec 15, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.21.1

Dec 13, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.21.0

Dec 8, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.20.1

Dec 8, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.20.0

Dec 6, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.19.0

Dec 2, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.18.0

Dec 2, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ var ErrRollbackWithActiveBranch = fmt.Errorf("%w: rollback with active branch", ErrFeatureNotSupported)

v0.17.0

Nov 26, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const DefaultCommitter

+ const ExportStatusRepaired

type Cataloger

+ BranchExists func(ctx context.Context, repository string, branch string) (bool, error)

+ Commit func(ctx context.Context, repository, branch string, message string, ...) (*CommitLog, error)

+ CreateBranch func(ctx context.Context, repository, branch string, sourceBranch string) (*CommitLog, error)

+ CreateEntries func(ctx context.Context, repository, branch string, entries []Entry) error

+ CreateEntry func(ctx context.Context, repository, branch string, entry Entry, ...) error

+ CreateMultipartUpload func(ctx context.Context, repository, uploadID, path, physicalAddress string, ...) error

+ CreateRepository func(ctx context.Context, repository string, storageNamespace string, branch string) (*Repository, error)

+ DedupReportChannel func() chan *DedupReport

+ DeleteBranch func(ctx context.Context, repository, branch string) error

+ DeleteEntry func(ctx context.Context, repository, branch string, path string) error

+ DeleteMultipartUpload func(ctx context.Context, repository, uploadID string) error

+ DeleteOrUnmarkObjectsForDeletion func(ctx context.Context, repositoryName string) (StringIterator, error)

+ DeleteRepository func(ctx context.Context, repository string) error

+ Diff func(ctx context.Context, repository, leftReference string, rightReference string, ...) (Differences, bool, error)

+ DiffUncommitted func(ctx context.Context, repository, branch string, limit int, after string) (Differences, bool, error)

+ ExportStateSet func(repo, branch string, cb ExportStateCallback) error

+ GetBranchReference func(ctx context.Context, repository, branch string) (string, error)

+ GetCommit func(ctx context.Context, repository, reference string) (*CommitLog, error)

+ GetEntry func(ctx context.Context, repository, reference string, path string, ...) (*Entry, error)

+ GetExportConfigurationForBranch func(repository string, branch string) (ExportConfiguration, error)

+ GetExportConfigurations func() ([]ExportConfigurationForBranch, error)

+ GetExportState func(repo string, branch string) (ExportState, error)

+ GetMultipartUpload func(ctx context.Context, repository, uploadID string) (*MultipartUpload, error)

+ GetRepository func(ctx context.Context, repository string) (*Repository, error)

+ Hooks func() *CatalogerHooks

+ ListBranches func(ctx context.Context, repository string, prefix string, limit int, after string) ([]*Branch, bool, error)

+ ListCommits func(ctx context.Context, repository, branch string, fromReference string, ...) ([]*CommitLog, bool, error)

+ ListEntries func(ctx context.Context, repository, reference string, prefix, after string, ...) ([]*Entry, bool, error)

+ ListRepositories func(ctx context.Context, limit int, after string) ([]*Repository, bool, error)

+ MarkEntriesExpired func(ctx context.Context, repositoryName string, expireResults []*ExpireResult) error

+ MarkObjectsForDeletion func(ctx context.Context, repositoryName string) (int64, error)

+ Merge func(ctx context.Context, ...) (*MergeResult, error)

+ PutExportConfiguration func(repository string, branch string, conf *ExportConfiguration) error

+ QueryEntriesToExpire func(ctx context.Context, repositoryName string, policy *Policy) (ExpiryRows, error)

+ ResetBranch func(ctx context.Context, repository, branch string) error

+ ResetEntries func(ctx context.Context, repository, branch string, prefix string) error

+ ResetEntry func(ctx context.Context, repository, branch string, path string) error

+ RollbackCommit func(ctx context.Context, repository, reference string) error

type ExportConfiguration

+ IsContinuous bool

type ExportConfigurationForBranch

+ IsContinuous bool

+ type ExportState struct

+ CurrentRef string

+ ErrorMessage *string

+ State CatalogBranchExportStatus

+ type ExportStateCallback func(oldRef string, state CatalogBranchExportStatus) (newRef string, newState CatalogBranchExportStatus, newMessage *string, ...)

+ type PostCommitFunc func(ctx context.Context, repo, branch string, commitLog CommitLog) error

+ type PostMergeFunc func(ctx context.Context, repo, branch string, mergeResult MergeResult) error

+ type StringIterator interface

+ Close func()

+ Err func() error

+ Next func() bool

+ Read func() (string, error)

v0.16.2

Nov 16, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ var ErrMinCommitsMismatch = errors.New("MinCommits length mismatch")

type DBLineageScannerOptions

+ MinCommits []CommitID

v0.16.1

Nov 13, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.16.0

Nov 12, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const BranchScannerMaxCommitsInFilter

+ const ExportStatusFailed

+ const ExportStatusInProgress

+ const ExportStatusSuccess

+ const ExportStatusUnknown

+ const MergeBatchChanBuffer

+ const MergeBatchSize

+ var ErrBadTypeConversion = errors.New("bad type")

+ var ErrExportFailed = errors.New("export failed")

+ var ErrLineageCorrupted = errors.New("lineage corrupted")

+ var ErrNonDirectNotSupported = errors.New("non direct diff not supported")

+ var ErrSameBranchMergeNotSupported = errors.New("same branch merge not supported")

+ func ScanDBEntriesUntil(s DBScanner, p string) error

+ type CatalogBranchExportStatus string

+ func (dst *CatalogBranchExportStatus) Scan(src interface{}) error

+ func (src CatalogBranchExportStatus) Value() (driver.Value, error)

type DBBranchScanner

+ func (s *DBBranchScanner) SetAdditionalWhere(part sq.Sqlizer)

type DBLineageScanner

+ func (s *DBLineageScanner) SetAdditionalWhere(part sq.Sqlizer)

+ type DBLineageScannerOptions struct

+ Lineage []lineageCommit

type DBScanner

+ SetAdditionalWhere func(s sq.Sqlizer)

+ type DiffResultRecord struct

+ EntryCtid *string

+ TargetEntryNotInDirectBranch bool

+ type DiffScanner struct

+ Relation RelationType

+ func NewDiffScanner(tx db.Tx, params doDiffParams) (*DiffScanner, error)

+ func (s *DiffScanner) Error() error

+ func (s *DiffScanner) Next() bool

+ func (s *DiffScanner) Value() *DiffResultRecord

type ExpiryRows

+ Close func()

+ type ExportStateHandler interface

+ ExportState func(repo, branch, newRef string, ...) error

+ ExportStateDelete func(tx db.Tx, repo string, branch string) error

+ ExportStateMarkEnd func(tx db.Tx, repo string, branch string, ref string, ...) error

+ ExportStateMarkStart func(tx db.Tx, repo string, branch string, newRef string) (string, CatalogBranchExportStatus, error)

+ type ExportStatus struct

+ CurrentRef string

+ State CatalogBranchExportStatus

v0.15.0

Oct 26, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const DBEntryFieldChecksum

+ const DBEntryFieldPhysicalAddress

+ const DBScannerDefaultBufferSize

+ const DefaultBranchName

+ const DefaultImportBranchName

+ type CatalogerHooks struct

+ PostCommit []func(ctx context.Context, tx db.Tx, commitLog *CommitLog) error

+ PostMerge []func(ctx context.Context, tx db.Tx, mergeResult *MergeResult) error

+ func (h *CatalogerHooks) AddPostCommit(f func(context.Context, db.Tx, *CommitLog) error) *CatalogerHooks

+ func (h *CatalogerHooks) AddPostMerge(f func(context.Context, db.Tx, *MergeResult) error) *CatalogerHooks

+ type DBBranchScanner struct

+ func NewDBBranchScanner(tx db.Tx, branchID int64, commitID CommitID, opts *DBScannerOptions) *DBBranchScanner

+ func (s *DBBranchScanner) Err() error

+ func (s *DBBranchScanner) Next() bool

+ func (s *DBBranchScanner) Value() *DBScannerEntry

+ type DBLineageScanner struct

+ func NewDBLineageScanner(tx db.Tx, branchID int64, commitID CommitID, opts *DBScannerOptions) *DBLineageScanner

+ func (s *DBLineageScanner) Err() error

+ func (s *DBLineageScanner) Next() bool

+ func (s *DBLineageScanner) ReadLineage() ([]lineageCommit, error)

+ func (s *DBLineageScanner) Value() *DBScannerEntry

+ type DBScanner interface

+ Err func() error

+ Next func() bool

+ Value func() *DBScannerEntry

+ type DBScannerEntry struct

+ BranchID int64

+ RowCtid string

+ func ScanDBEntryUntil(s DBScanner, ent *DBScannerEntry, p string) (*DBScannerEntry, error)

+ type DBScannerOptions struct

+ AdditionalFields []string

+ AdditionalWhere sq.Sqlizer

+ After string

+ BufferSize int

+ type DiffParams struct

+ AdditionalFields []string

+ After string

+ Limit int

type DifferenceType

+ const DifferenceTypeNone

+ type ExportConfiguration struct

+ LastKeysInPrefixRegexp pq.StringArray

+ Path string

+ StatusPath string

+ type ExportConfigurationForBranch struct

+ Branch string

+ LastKeysInPrefixRegexp pq.StringArray

+ Path string

+ Repository string

+ StatusPath string

+ type ExportConfigurator interface

+ GetExportConfigurationForBranch func(repository string, branch string) (ExportConfiguration, error)

+ GetExportConfigurations func() ([]ExportConfigurationForBranch, error)

+ PutExportConfiguration func(repository string, branch string, conf *ExportConfiguration) error

+ type Hookser interface

+ Hooks func() *CatalogerHooks

type RelationType

+ const RelationTypeSame

v0.14.0

Oct 14, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.13.0

Oct 4, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const MinCommitUncommittedIndicator

+ const TombstoneCommitID

+ type MinMaxCommit struct

+ MaxCommit CommitID

+ MinCommit CommitID

+ func (m MinMaxCommit) ChangedAfterCommit(commitID CommitID) bool

+ func (m MinMaxCommit) IsCommitted() bool

+ func (m MinMaxCommit) IsDeleted() bool

+ func (m MinMaxCommit) IsTombstone() bool

v0.12.0

Oct 1, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const DBReaderMaxLimit

+ type DBBranchReader struct

+ EOF bool

+ func NewDBBranchReader(tx db.Tx, branchID int64, commitID CommitID, bufSize int, after string) *DBBranchReader

+ func (r *DBBranchReader) Next() (*DBReaderEntry, error)

+ type DBLineageReader struct

+ EOF bool

+ func NewDBLineageReader(tx db.Tx, branchID int64, commitID CommitID, bufSize int, limit int, ...) (*DBLineageReader, error)

+ func (r *DBLineageReader) Next() (*DBReaderEntry, error)

+ type DBReaderEntry struct

+ BranchID int64

+ MaxCommit CommitID

+ MinCommit CommitID

+ Path string

+ RowCtid string

v0.11.1

Oct 1, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ var ErrMissingDiffResultsIDInContext = errors.New("missing diff results id in context")

v0.11.0

Sep 27, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.10.2

Sep 17, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.10.1

Sep 15, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.10.0

Sep 14, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const DiffMaxLimit

type CatalogerOption

+ func WithCacheEnabled(b bool) CatalogerOption

+ func WithParams(p params.Catalog) CatalogerOption

type MergeResult

+ Summary map[DifferenceType]int

v0.9.0

Sep 1, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const MaxReadQueue

+ var ErrByteSliceTypeAssertion = errors.New("type assertion to []byte failed")

+ var ErrInvalidMetadataSrcFormat = errors.New("invalid metadata src format")

+ var ErrReadEntryTimeout = errors.New("read entry timeout")

+ var ErrUnexpected = errors.New("unexpected error")

type CatalogerOption

+ func WithBatchReadParams(p params.BatchRead) CatalogerOption

type EntryCataloger

+ DeleteOrUnmarkObjectsForDeletion func(ctx context.Context, repositoryName string) (StringRows, error)

+ MarkEntriesExpired func(ctx context.Context, repositoryName string, expireResults []*ExpireResult) error

+ MarkObjectsForDeletion func(ctx context.Context, repositoryName string) (int64, error)

+ QueryEntriesToExpire func(ctx context.Context, repositoryName string, policy *Policy) (ExpiryRows, error)

type RelationType

+ const RelationTypeFromChild

+ const RelationTypeFromParent

+ type StringRows struct

+ func (s *StringRows) Close() error

+ func (s *StringRows) Err() error

+ func (s *StringRows) Next() bool

+ func (s *StringRows) Read() (string, error)

v0.8.2

Aug 6, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

v0.8.1

Aug 3, 2020 GO-2022-0375 +4 more

GO-2022-0375: Improper Access Control in github.com/treeverse/lakefs

GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ const CatalogerCommitter

+ const CommitPrefix

+ const CommittedID

+ const CommittedSuffix

+ const DefaultPathDelimiter

+ const DirectoryTermination

+ const DirectoryTerminationValue

+ const InternalObjectRefFormat

+ const InternalObjectRefParts

+ const InternalObjectRefSeparator