Fix prefixing bug in import verifier

In order to check if an import is of an allowed tree, we need to check that the import is either literally to the base of the tree or that the import is below the tree (the import, suffixed with `/`, should be a prefix) instead of checking simply that the import is a prefix of the allowed tree, as that causes issues with packages that are prefixes of each other, like `k8s.io/api` and `k8s.io/apimachinery`. Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>

Fix prefixing bug in import verifier
3c3e0f14 · Steve Kuznetsov · 2f00e6d7 · 3c3e0f14 · 3c3e0f14
Unverified Commit 3c3e0f14 authored Aug 23, 2017 by Steve Kuznetsov
Hide whitespace changes
Inline Side-by-side

Showing with 11 additions and 1 deletion

OWNERS cmd/importverifier/OWNERS +8 -0

importverifier.go cmd/importverifier/importverifier.go +3 -1

No files found.
--- a/cmd/importverifier/OWNERS
+++ b/cmd/importverifier/OWNERS
+reviewers:
+  - stevekuznetsov 
+  - deads2k
+  - sttts 
+approvers:
+  - stevekuznetsov 
+  - deads2k
+  - sttts 
--- a/cmd/importverifier/importverifier.go
+++ b/cmd/importverifier/importverifier.go
@@ -152,7 +152,9 @@ func (i *ImportRestriction) isForbidden(imp string) bool {
 	importsBelowBase := strings.HasPrefix(imp, i.BaseDir)
 	importsAllowed := false
 	for _, allowed := range i.AllowedImports {
-		importsAllowed = importsAllowed || strings.HasPrefix(imp, allowed)
+		exactlyImportsAllowed := imp == allowed
+		importsBelowAllowed := strings.HasPrefix(imp, fmt.Sprintf("%s/", allowed))
+		importsAllowed = importsAllowed || (importsBelowAllowed || exactlyImportsAllowed)
 	}

 	return importsBelowRoot && !importsBelowBase && !importsAllowed