Skip to content

K
k3s
Commit f1773894 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #48536 from CaoShuFeng/application/json

Automatic merge from submit-queue Fix invalid Content-Type for 403 error https://github.com/kubernetes/kubernetes/pull/47384 makes 403 errors return Status Object. However the Content-Type is still "text/plain" This change fixes it. Before this change: kubectl get pods --as=tom Error from server (Forbidden): {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods \"\" is forbidden: User \"tom\" cannot list pods in the namespace \"default\".","reason":"Forbidden","details":{"kind":"pods"},"code":403} (get pods) After this change: $ kubectl get pods --as=tom Error from server (Forbidden): pods "" is forbidden: User "tom" cannot list pods in the namespace "default". **What this PR does / why we need it**: **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # **Special notes for your reviewer**: **Release note**: ``` NONE ```
parents 20e629b1 36e0a5ed
Hide whitespace changes
Inline Side-by-side
Showing with 13 additions and 9 deletions
staging/src/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/errors.go
View file @ f1773894
...@@ -44,7 +44,6 @@ func BadGatewayError(w http.ResponseWriter, req *http.Request) { ...@@ -44,7 +44,6 @@ func BadGatewayError(w http.ResponseWriter, req *http.Request) {
func Forbidden(ctx request.Context, attributes authorizer.Attributes, w http.ResponseWriter, req *http.Request, reason string, s runtime.NegotiatedSerializer) { func Forbidden(ctx request.Context, attributes authorizer.Attributes, w http.ResponseWriter, req *http.Request, reason string, s runtime.NegotiatedSerializer) {
msg := sanitizer.Replace(forbiddenMessage(attributes)) msg := sanitizer.Replace(forbiddenMessage(attributes))
w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("X-Content-Type-Options", "nosniff")
w.WriteHeader(http.StatusForbidden)
var errMsg string var errMsg string
if len(reason) == 0 { if len(reason) == 0 {
......
staging/src/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/errors_test.go
View file @ f1773894
...@@ -63,18 +63,19 @@ func TestErrors(t *testing.T) { ...@@ -63,18 +63,19 @@ func TestErrors(t *testing.T) {
func TestForbidden(t *testing.T) { func TestForbidden(t *testing.T) {
u := &user.DefaultInfo{Name: "NAME"} u := &user.DefaultInfo{Name: "NAME"}
cases := []struct { cases := []struct {
expected string expected string
attributes authorizer.Attributes attributes authorizer.Attributes
reason string reason string
contentType string
}{ }{
{`{"metadata":{},"status":"Failure","message":" \"\" is forbidden: User \"NAME\" cannot GET path \"/whatever\".","reason":"Forbidden","details":{},"code":403} {`{"metadata":{},"status":"Failure","message":" \"\" is forbidden: User \"NAME\" cannot GET path \"/whatever\".","reason":"Forbidden","details":{},"code":403}
`, authorizer.AttributesRecord{User: u, Verb: "GET", Path: "/whatever"}, ""}, `, authorizer.AttributesRecord{User: u, Verb: "GET", Path: "/whatever"}, "", "application/json"},
{`{"metadata":{},"status":"Failure","message":" \"\" is forbidden: User \"NAME\" cannot GET path \"/\u0026lt;script\u0026gt;\".","reason":"Forbidden","details":{},"code":403} {`{"metadata":{},"status":"Failure","message":" \"\" is forbidden: User \"NAME\" cannot GET path \"/\u0026lt;script\u0026gt;\".","reason":"Forbidden","details":{},"code":403}
`, authorizer.AttributesRecord{User: u, Verb: "GET", Path: "/<script>"}, ""}, `, authorizer.AttributesRecord{User: u, Verb: "GET", Path: "/<script>"}, "", "application/json"},
{`{"metadata":{},"status":"Failure","message":"pod \"\" is forbidden: User \"NAME\" cannot GET pod at the cluster scope.","reason":"Forbidden","details":{"kind":"pod"},"code":403} {`{"metadata":{},"status":"Failure","message":"pod \"\" is forbidden: User \"NAME\" cannot GET pod at the cluster scope.","reason":"Forbidden","details":{"kind":"pod"},"code":403}
`, authorizer.AttributesRecord{User: u, Verb: "GET", Resource: "pod", ResourceRequest: true}, ""}, `, authorizer.AttributesRecord{User: u, Verb: "GET", Resource: "pod", ResourceRequest: true}, "", "application/json"},
{`{"metadata":{},"status":"Failure","message":"pod.v2 \"\" is forbidden: User \"NAME\" cannot GET pod.v2/quota in the namespace \"test\".","reason":"Forbidden","details":{"group":"v2","kind":"pod"},"code":403} {`{"metadata":{},"status":"Failure","message":"pod.v2 \"\" is forbidden: User \"NAME\" cannot GET pod.v2/quota in the namespace \"test\".","reason":"Forbidden","details":{"group":"v2","kind":"pod"},"code":403}
`, authorizer.AttributesRecord{User: u, Verb: "GET", Namespace: "test", APIGroup: "v2", Resource: "pod", Subresource: "quota", ResourceRequest: true}, ""}, `, authorizer.AttributesRecord{User: u, Verb: "GET", Namespace: "test", APIGroup: "v2", Resource: "pod", Subresource: "quota", ResourceRequest: true}, "", "application/json"},
} }
for _, test := range cases { for _, test := range cases {
observer := httptest.NewRecorder() observer := httptest.NewRecorder()
...@@ -83,7 +84,11 @@ func TestForbidden(t *testing.T) { ...@@ -83,7 +84,11 @@ func TestForbidden(t *testing.T) {
Forbidden(request.NewDefaultContext(), test.attributes, observer, &http.Request{}, test.reason, negotiatedSerializer) Forbidden(request.NewDefaultContext(), test.attributes, observer, &http.Request{}, test.reason, negotiatedSerializer)
result := string(observer.Body.Bytes()) result := string(observer.Body.Bytes())
if result != test.expected { if result != test.expected {
t.Errorf("Forbidden(%#v...) != %#v, got %#v", test.attributes, test.expected, result) t.Errorf("Forbidden response body(%#v...) != %#v, got %#v", test.attributes, test.expected, result)
}
resultType := observer.HeaderMap.Get("Content-Type")
if resultType != test.contentType {
t.Errorf("Forbidden content type(%#v...) != %#v, got %#v", test.attributes, test.expected, result)
} }
} }
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment