strict-validate-path-type does not allow period/dot/. in Exact or Prefix path

[rouke-broersma]

What happened:

The documentation mentions the following text:

When pathType is configured as Exact or Prefix, there should be a more strict validation, allowing only paths starting with "/" and containing only alphanumeric characters and "-", "_" and additional "/".

However the term alphanumeric characters is not specified and the term does not seem to be universally specified either. Some sources for example include special characters in alphanumeric characters, which seems to defeat the purpose of the strict checking.

The current text, depending on the definition of alphanumeric characters, seems to suggest that for example the period . character is not allowed when using Exact or Prefix. This would mean that a path of https://example.com/index.html, https://example.com/.well-known/openid-configuration or https://example.com/.well-known/acme-challenge/3857265 would be invalid for path type Exact and Prefix. I cannot imagine that it's intentional that all these super common url's would be unsupported by Exact or Prefix.

What you expected to happen:

Define the term alphanumeric characters as used by this project and allow . in Exact and Prefix path types.

/kind documentation
/remove-kind bug

[longwuyuan]

Then does this https://kubernetes.io/docs/concepts/overview/working-with-objects/names/ page also has the words alphanumeric characters

[longwuyuan]

also https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

[longwuyuan]

And I could be wrong, but period/dot/. is known as a separator

[rouke-broersma]

@longwuyuan You're linking documentation in the context of Kubernetes objects, but these requirements are not the same as used by ingress-nginx for path validation. This documentation does indeed mention that alphanumeric means [a-z0-9A-Z] in this context, but ingress-nginx does not define what alphanumeric means. If alphanumeric in the context of ingress-nginx means the same as the definition as defined in the documents you linked, then I think this should be mentioned in the docs for strict-validate-path-type.

I looked up the validation of the path as used by ingress-nginx here:

ingress-nginx/internal/ingress/inspector/rules.go

Line 37 in e44cab7

validPathType = regexp.MustCompile(`(?i)^/[[:alnum:]\_\-/]*$`)

And I could be wrong, but period/dot/. is known as a separator

Be that as it may, this is not supported by the path validation in ingress-nginx so you can't even host static files with a file extenstion (index.html for example) using Exact or Prefix paths when strict-validate-path-type is enabled.

See: https://regex101.com/r/WjwI0c/1

I think this is an oversight and that . should be supported in Exact and Prefix path types. So actually perhaps this is not only a documentation issue but also either a bug or a feature request.

[longwuyuan]

thanks @rouke-broersma , maybe we should keep adding thoughts here so it helps make progress.

• Could you paste a sample ingress manifest and the log messages for an attempt to create that sample
• Would you opine that the suggested changes improve security or risk stays the same as now or risk is increased

[rouke-broersma]

@longwuyuan here is an ingress from my existing homelab:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bazarr-auth
  namespace: authentik
spec:
  rules:
    - host: bazarr.example.com
      http:
        paths:
          - backend:
              service:
                name: ak-outpost-authentik-embedded-outpost
                port:
                  number: 9000
            path: /outpost.goauthentik.io
            pathType: Prefix

Log message:

admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: ingress contains invalid paths: path /outpost.goauthentik.io cannot be used with pathType Prefix

I would say that since / is required in the path and period/dot/. is not a special character when in the path that there is no increased security risk in allowing this character in Exact and Prefix.

I would say that allowing the commonly used period/dot/. in Exact and Prefix instead of only in ImplementationSpecific increases security because ImplementationSpecific is not validated but a user is now forced to use it.

[longwuyuan]

• I see your path starts with "forward slash" char
• I see docs saying paths starting with "forward slash" are allowed
  

[rouke-broersma]

@longwuyuan I know / is allowed. In fact / is required. I'm saying since / is required there is no risk in allowing .. If / was not required then allowing . might be a risk, because a user could create a ingress like this:

    - host: bazarr.example.com
      http:
        paths:
            path: .outpost.goauthentik.io
            pathType: Prefix

This might change the host part instead of only the path part of the ingress, which could be a concern. However since / is required, this is not a concern.