chore(redis): Please gosec checking

Signed-off-by: Oliver Gondža <ogondza@gmail.com>

Author: olivergondza

controllers/argocd/configmap.go

@@ -778,7 +778,7 @@ func (r *ReconcileArgoCD) reconcileRedisHAConfigMap(cr *argoproj.ArgoCD, useTLSF
 	desired := newConfigMapWithName(common.ArgoCDRedisHAConfigMapName, cr)
 	desired.Data = map[string]string{
 		"haproxy.cfg":     getRedisHAProxyConfig(cr, useTLSForRedis),
-		"haproxy_init.sh": getRedisHAProxyScript(cr),
+		"haproxy_init.sh": getRedisHAProxyScript(),
 		"init.sh":         getRedisInitScript(),
 		"redis.conf":      getRedisConf(useTLSForRedis),
 		"sentinel.conf":   getRedisSentinelConf(useTLSForRedis),
@@ -841,7 +841,7 @@ func (r *ReconcileArgoCD) recreateRedisHAConfigMap(cr *argoproj.ArgoCD, useTLSFo
 	return r.reconcileRedisHAConfigMap(cr, useTLSForRedis)
 }
 
-func (r *ReconcileArgoCD) recreateRedisHAHealthConfigMap(cr *argoproj.ArgoCD, useTLSForRedis bool) error {
+func (r *ReconcileArgoCD) recreateRedisHAHealthConfigMap(cr *argoproj.ArgoCD) error {
 	cm := newConfigMapWithName(common.ArgoCDRedisHAHealthConfigMapName, cr)
 
 	exists, err := argoutil.IsObjectFound(r.Client, cr.Namespace, cm.Name, cm)

controllers/argocd/secret.go

@@ -650,7 +650,7 @@ func (r *ReconcileArgoCD) reconcileRedisTLSSecret(cr *argoproj.ArgoCD, useTLSFor
 			if err != nil {
 				return err
 			}
-			err = r.recreateRedisHAHealthConfigMap(cr, useTLSForRedis)
+			err = r.recreateRedisHAHealthConfigMap(cr)
 			if err != nil {
 				return err
 			}

controllers/argocd/util.go

@@ -426,6 +426,21 @@ func getRedisConfigPath() string {
 	return common.ArgoCDDefaultRedisConfigPath
 }
 
+func getRedisConfigContent(segment string) string {
+	base := getRedisConfigPath()
+	fp := filepath.Clean(filepath.Join(base, segment))
+	if !strings.HasPrefix(fp, base) {
+		panic(fmt.Errorf("unsafe path for %s + %s", base, segment))
+	}
+
+	data, err := os.ReadFile(fp)
+	if err != nil {
+		log.Error(err, "unable to load redis "+segment)
+		return ""
+	}
+	return string(data)
+}
+
 // getRedisInitScript will load the redis configuration from a template on disk for the given ArgoCD.
 // If an error occurs, an empty string value will be returned.
 func getRedisConf(useTLSForRedis bool) string {
@@ -506,16 +521,10 @@ func getRedisHAProxyContainerImage(cr *argoproj.ArgoCD) string {
 	return argoutil.CombineImageTag(img, tag)
 }
 
-// getRedisInitScript will load the redis init script from a template on disk for the given ArgoCD.
+// getRedisInitScript will load the redis init script
 // If an error occurs, an empty string value will be returned.
 func getRedisInitScript() string {
-	path := filepath.Join(getRedisConfigPath(), "init.sh")
-	data, err := os.ReadFile(path)
-	if err != nil {
-		log.Error(err, "unable to load redis init.sh")
-		return ""
-	}
-	return string(data)
+	return getRedisConfigContent("init.sh")
 }
 
 // getRedisHAProxySConfig will load the Redis HA Proxy configuration from a template on disk for the given ArgoCD.
@@ -535,16 +544,10 @@ func getRedisHAProxyConfig(cr *argoproj.ArgoCD, useTLSForRedis bool) string {
 	return script
 }
 
-// getRedisHAProxyScript will load the Redis HA Proxy init script from a template on disk for the given ArgoCD.
+// getRedisHAProxyScript will load the Redis HA Proxy init script
 // If an error occurs, an empty string value will be returned.
-func getRedisHAProxyScript(cr *argoproj.ArgoCD) string {
-	path := filepath.Join(getRedisConfigPath(), "haproxy_init.sh")
-	data, err := os.ReadFile(path)
-	if err != nil {
-		log.Error(err, "unable to load redis haproxy_init.sh")
-		return ""
-	}
-	return string(data)
+func getRedisHAProxyScript() string {
+	return getRedisConfigContent("haproxy_init.sh")
 }
 
 // getRedisResources will return the ResourceRequirements for the Redis container.
@@ -586,40 +589,22 @@ func getRedisSentinelConf(useTLSForRedis bool) string {
 	return conf
 }
 
-// getRedisLivenessScript will load the redis liveness script from a template on disk for the given ArgoCD.
+// getRedisLivenessScript will load the redis liveness script
 // If an error occurs, an empty string value will be returned.
 func getRedisLivenessScript() string {
-	path := filepath.Join(getRedisConfigPath(), "redis_liveness.sh")
-	data, err := os.ReadFile(path)
-	if err != nil {
-		log.Error(err, "unable to load redis redis_liveness.sh")
-		return ""
-	}
-	return string(data)
+	return getRedisConfigContent("redis_liveness.sh")
 }
 
-// getRedisReadinessScript will load the redis readiness script from a template on disk for the given ArgoCD.
+// getRedisReadinessScript will load the redis readiness script
 // If an error occurs, an empty string value will be returned.
 func getRedisReadinessScript() string {
-	path := filepath.Join(getRedisConfigPath(), "redis_readiness.sh")
-	data, err := os.ReadFile(path)
-	if err != nil {
-		log.Error(err, "unable to load redis redis_readiness.sh")
-		return ""
-	}
-	return string(data)
+	return getRedisConfigContent("redis_readiness.sh")
 }
 
-// getSentinelLivenessScript will load the redis liveness script from a template on disk for the given ArgoCD.
+// getSentinelLivenessScript will load the redis liveness script
 // If an error occurs, an empty string value will be returned.
 func getSentinelLivenessScript() string {
-	path := filepath.Join(getRedisConfigPath(), "sentinel_liveness.sh")
-	data, err := os.ReadFile(path)
-	if err != nil {
-		log.Error(err, "unable to load redis sentinel_liveness.sh")
-		return ""
-	}
-	return string(data)
+	return getRedisConfigContent("sentinel_liveness.sh")
 }
 
 // getRedisServerAddress will return the Redis service address for the given ArgoCD.