backport of Orchestrator/release 1.10 to orchestrator/workspace (#3586)

* bump fast-uri (#3454)

* [release-1.10] chore(deps): bump Orchestrator deps to resolve 1.10.2 CVEs (#3537)

Signed-off-by: Jessica He <jhe@redhat.com>

* fix: allow properly quoted LoqQL querys in the selector field. (#3533) (#3552)

fixes https://redhat.atlassian.net/browse/RHDHSUPP-381

assisted by cursor

---------

Signed-off-by: Jessica He <jhe@redhat.com>
Co-authored-by: André <alizardo@redhat.com>
Co-authored-by: Jessica He <jhe@redhat.com>

Author: 3 people

workspaces/orchestrator/.changeset/heavy-lions-own.md

@@ -0,0 +1,5 @@
+---
+'@red-hat-developer-hub/backstage-plugin-orchestrator-backend-module-loki': patch
+---
+
+Fix to allow properly quoted LoqQL querys in the selector field

workspaces/orchestrator/plugins/orchestrator-backend-module-loki/src/workflowLogsProviders/LokiProvider.test.ts

@@ -159,7 +159,7 @@ describe('LokiProvider', () => {
             },
           }),
         ),
-      ).toThrow(/must not contain "\}"/);
+      ).toThrow(/must not contain unquoted "\{" or "\}"/);
     });
 
     it('rejects logPipelineFilters containing opening brace', () => {
@@ -171,13 +171,13 @@ describe('LokiProvider', () => {
                 loki: {
                   baseUrl: 'http://localhost:3100',
                   token: 't',
-                  logPipelineFilters: ['| pattern `{stream}`'],
+                  logPipelineFilters: ['| foo {bar="baz"}'],
                 },
               },
             },
           }),
         ),
-      ).toThrow(/must not contain "\{"/);
+      ).toThrow(/must not contain unquoted "\{" or "\}"/);
     });
 
     it('rejects logPipelineFilters entries that trim to empty (whitespace-only)', () => {

workspaces/orchestrator/plugins/orchestrator-backend-module-loki/src/workflowLogsProviders/helpers.test.ts

@@ -79,6 +79,47 @@ describe('parseAndValidateLogPipelineFilters', () => {
       /orchestrator\.workflowLogProvider\.loki\.logPipelineFilters\[0\]: entry must not contain line breaks/,
     );
   });
+
+  it('accepts line_format with Go template braces inside double quotes', () => {
+    const mockConfig = {
+      getOptionalStringArray: () => ['| line_format "{{.message}}"'],
+    } as unknown as Config;
+    expect(
+      parseAndValidateLogPipelineFilters(
+        mockConfig,
+        'orchestrator.workflowLogProvider.loki.logPipelineFilters',
+      ),
+    ).toEqual(['| line_format "{{.message}}"']);
+  });
+
+  it('accepts braces inside backtick-quoted pattern literals', () => {
+    const mockConfig = {
+      getOptionalStringArray: () => ['| pattern `{stream}`'],
+    } as unknown as Config;
+    expect(
+      parseAndValidateLogPipelineFilters(
+        mockConfig,
+        'orchestrator.workflowLogProvider.loki.logPipelineFilters',
+      ),
+    ).toEqual(['| pattern `{stream}`']);
+  });
+
+  it.each([['| json }'], ['| foo {bar="baz"}']])(
+    'rejects unquoted braces: %s',
+    raw => {
+      const mockConfig = {
+        getOptionalStringArray: () => [raw],
+      } as unknown as Config;
+      expect(() =>
+        parseAndValidateLogPipelineFilters(
+          mockConfig,
+          'orchestrator.workflowLogProvider.loki.logPipelineFilters',
+        ),
+      ).toThrow(
+        /orchestrator\.workflowLogProvider\.loki\.logPipelineFilters\[0\]: entry must not contain unquoted "\{" or "\}"/,
+      );
+    },
+  );
 });
 
 describe('hostnameMatchesAllowedHosts', () => {

workspaces/orchestrator/plugins/orchestrator-backend-module-loki/src/workflowLogsProviders/helpers.ts

@@ -178,6 +178,55 @@ export function parseAndValidateLogStreamSelectors(
   });
 }
 
+/**
+ * Rejects `{` / `}` outside quoted LogQL literals so pipeline config cannot
+ * close the stream selector (`{...}`) and inject a new selector. Braces inside
+ * `"..."` or `` `...` `` (e.g. `line_format "{{.message}}"`) are allowed.
+ */
+function assertNoUnquotedLogQlBraces(element: string, context: string): void {
+  let i = 0;
+  while (i < element.length) {
+    const ch = element[i];
+    if (ch === '"') {
+      i = skipQuotedString(element, i + 1, '"', context);
+      continue;
+    }
+    if (ch === '`') {
+      i = skipQuotedString(element, i + 1, '`', context);
+      continue;
+    }
+    if (ch === '{' || ch === '}') {
+      throw new InputError(
+        `${context}: entry must not contain unquoted "{" or "}"`,
+      );
+    }
+    i++;
+  }
+}
+
+function skipQuotedString(
+  element: string,
+  start: number,
+  quote: '"' | '`',
+  context: string,
+): number {
+  let i = start;
+  while (i < element.length) {
+    const ch = element[i];
+    if (quote === '"' && ch === '\\') {
+      i += 2;
+      continue;
+    }
+    if (ch === quote) {
+      return i + 1;
+    }
+    i++;
+  }
+  throw new InputError(
+    `${context}: entry contains an unclosed ${quote === '"' ? 'double-quoted' : 'backtick-quoted'} string`,
+  );
+}
+
 /**
  * Reads and validates `logPipelineFilters` at startup.
  */
@@ -200,12 +249,7 @@ export function parseAndValidateLogPipelineFilters(
     if (/[\r\n\u2028\u2029]/.test(element)) {
       throw new InputError(`${ctx}: entry must not contain line breaks`);
     }
-    if (element.includes('{')) {
-      throw new InputError(`${ctx}: entry must not contain "{"`);
-    }
-    if (element.includes('}')) {
-      throw new InputError(`${ctx}: entry must not contain "}"`);
-    }
+    assertNoUnquotedLogQlBraces(element, ctx);
     return element;
   });
 }

workspaces/orchestrator/yarn.lock

@@ -18281,12 +18281,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.11.0, acorn@npm:^8.14.1, acorn@npm:^8.16.0, acorn@npm:^8.4.1, acorn@npm:^8.8.2, acorn@npm:^8.9.0":
-  version: 8.16.0
-  resolution: "acorn@npm:8.16.0"
+"acorn@npm:^8.11.0, acorn@npm:^8.15.0, acorn@npm:^8.16.0, acorn@npm:^8.4.1, acorn@npm:^8.8.2, acorn@npm:^8.9.0":
+  version: 8.17.0
+  resolution: "acorn@npm:8.17.0"
   bin:
     acorn: bin/acorn
-  checksum: 10c0/c9c52697227661b68d0debaf972222d4f622aa06b185824164e153438afa7b08273432ca43ea792cadb24dada1d46f6f6bb1ef8de9956979288cc1b96bf9914e
+  checksum: 10c0/5dcefea5f8f023b6cc24cbe71fb5a8112b601d36c4fa07d14e4e6ffc2ee47383332c46b36c766d9437725aa6660156eae50efa0c838719823b50d7c327c4ed42
   languageName: node
   linkType: hard
 
@@ -19219,13 +19219,14 @@ __metadata:
   linkType: hard
 
 "axios@npm:^1.0.0, axios@npm:^1.12.0, axios@npm:^1.12.2, axios@npm:^1.13.6, axios@npm:^1.15.0":
-  version: 1.15.0
-  resolution: "axios@npm:1.15.0"
+  version: 1.18.1
+  resolution: "axios@npm:1.18.1"
   dependencies:
-    follow-redirects: "npm:^1.15.11"
+    follow-redirects: "npm:^1.16.0"
     form-data: "npm:^4.0.5"
+    https-proxy-agent: "npm:^5.0.1"
     proxy-from-env: "npm:^2.1.0"
-  checksum: 10c0/47e0f860e98d4d7aa145e89ce0cae00e1fb0f1d2485f065c21fce955ddb1dba4103a46bd0e47acd18a27208a7f62c96249e620db575521b92a968619ab133409
+  checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc
   languageName: node
   linkType: hard
 
@@ -24098,13 +24099,13 @@ __metadata:
   linkType: hard
 
 "express-rate-limit@npm:^8.2.2":
-  version: 8.3.2
-  resolution: "express-rate-limit@npm:8.3.2"
+  version: 8.5.2
+  resolution: "express-rate-limit@npm:8.5.2"
   dependencies:
-    ip-address: "npm:10.1.0"
+    ip-address: "npm:^10.2.0"
   peerDependencies:
     express: ">= 4.11"
-  checksum: 10c0/5b64d0691071086cdb8cfc6bcd5e761f5687cf4fabdebfe2a043ea5b4d31443637181e7be71e7ffabce76aee816daee62c1ca83250045847957da408a129f650
+  checksum: 10c0/c98c49b93e94627940cf5e7c2578718b94d77163357161c3343d148e46257136c988933a96d6e1e728a010683133a58f68cad46928b063cf8d99521c8772578d
   languageName: node
   linkType: hard
 
@@ -24336,9 +24337,9 @@ __metadata:
   linkType: hard
 
 "fast-uri@npm:^3.0.1":
-  version: 3.0.3
-  resolution: "fast-uri@npm:3.0.3"
-  checksum: 10c0/4b2c5ce681a062425eae4f15cdc8fc151fd310b2f69b1f96680677820a8b49c3cd6e80661a406e19d50f0c40a3f8bffdd458791baf66f4a879d80be28e10a320
+  version: 3.1.2
+  resolution: "fast-uri@npm:3.1.2"
+  checksum: 10c0/5b35641895959f3f7ab7a7b1b5542bded159346f25ec9f256817b206d50b64eda5828e90d605a2e2fc645c90519a7259c2bab2c942ee728c88b88e5be21b090d
   languageName: node
   linkType: hard
 
@@ -24649,7 +24650,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.15.11":
+"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.16.0":
   version: 1.16.0
   resolution: "follow-redirects@npm:1.16.0"
   peerDependenciesMeta:
@@ -26711,20 +26712,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ip-address@npm:10.1.0":
-  version: 10.1.0
-  resolution: "ip-address@npm:10.1.0"
-  checksum: 10c0/0103516cfa93f6433b3bd7333fa876eb21263912329bfa47010af5e16934eeeff86f3d2ae700a3744a137839ddfad62b900c7a445607884a49b5d1e32a3d7566
-  languageName: node
-  linkType: hard
-
-"ip-address@npm:^9.0.5":
-  version: 9.0.5
-  resolution: "ip-address@npm:9.0.5"
-  dependencies:
-    jsbn: "npm:1.1.0"
-    sprintf-js: "npm:^1.1.3"
-  checksum: 10c0/331cd07fafcb3b24100613e4b53e1a2b4feab11e671e655d46dc09ee233da5011284d09ca40c4ecbdfe1d0004f462958675c224a804259f2f78d2465a87824bc
+"ip-address@npm:^10.1.1, ip-address@npm:^10.2.0":
+  version: 10.2.0
+  resolution: "ip-address@npm:10.2.0"
+  checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a
   languageName: node
   linkType: hard
 
@@ -28189,7 +28180,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsbn@npm:1.1.0, jsbn@npm:^1.1.0":
+"jsbn@npm:^1.1.0":
   version: 1.1.0
   resolution: "jsbn@npm:1.1.0"
   checksum: 10c0/4f907fb78d7b712e11dea8c165fe0921f81a657d3443dde75359ed52eb2b5d33ce6773d97985a089f09a65edd80b11cb75c767b57ba47391fee4c969f7215c96
@@ -36168,13 +36159,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"shell-quote@npm:1.8.3, shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1":
+"shell-quote@npm:1.8.3":
   version: 1.8.3
   resolution: "shell-quote@npm:1.8.3"
   checksum: 10c0/bee87c34e1e986cfb4c30846b8e6327d18874f10b535699866f368ade11ea4ee45433d97bf5eada22c4320c27df79c3a6a7eb1bf3ecfc47f2c997d9e5e2672fd
   languageName: node
   linkType: hard
 
+"shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1":
+  version: 1.8.4
+  resolution: "shell-quote@npm:1.8.4"
+  checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40
+  languageName: node
+  linkType: hard
+
 "short-unique-id@npm:^5.3.2":
   version: 5.3.2
   resolution: "short-unique-id@npm:5.3.2"
@@ -36361,12 +36359,12 @@ __metadata:
   linkType: hard
 
 "socks@npm:^2.6.2, socks@npm:^2.8.3":
-  version: 2.8.3
-  resolution: "socks@npm:2.8.3"
+  version: 2.8.9
+  resolution: "socks@npm:2.8.9"
   dependencies:
-    ip-address: "npm:^9.0.5"
+    ip-address: "npm:^10.1.1"
     smart-buffer: "npm:^4.2.0"
-  checksum: 10c0/d54a52bf9325165770b674a67241143a3d8b4e4c8884560c4e0e078aace2a728dffc7f70150660f51b85797c4e1a3b82f9b7aa25e0a0ceae1a243365da5c51a7
+  checksum: 10c0/2d4350c31142b0931eb1758825b426bcbf4bfb5eed682ca48bc46dc9e7d1930ec366ea574ad49fc6c1fd9e9e17ce243be0ef13e31fc4b0319d9093f1fb19743c
   languageName: node
   linkType: hard
 
@@ -36523,7 +36521,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sprintf-js@npm:^1.1.2, sprintf-js@npm:^1.1.3":
+"sprintf-js@npm:^1.1.2":
   version: 1.1.3
   resolution: "sprintf-js@npm:1.1.3"
   checksum: 10c0/09270dc4f30d479e666aee820eacd9e464215cdff53848b443964202bf4051490538e5dd1b42e1a65cf7296916ca17640aebf63dae9812749c7542ee5f288dec
@@ -39407,14 +39405,14 @@ __metadata:
   linkType: hard
 
 "vm2@npm:^3.10.0":
-  version: 3.10.4
-  resolution: "vm2@npm:3.10.4"
+  version: 3.11.5
+  resolution: "vm2@npm:3.11.5"
   dependencies:
-    acorn: "npm:^8.14.1"
+    acorn: "npm:^8.15.0"
     acorn-walk: "npm:^8.3.4"
   bin:
     vm2: bin/vm2
-  checksum: 10c0/24b38bccd3fd84711f5526185ccb62c3607f35643f7e5425236ed4e7f0fa6249902713a5a5c4cb42267ec0199c3a10d5f27596a0794e03115cef0c8ae7683fe2
+  checksum: 10c0/0917795f8cfb9e0e4bcbb431d44546eda492165143885d448a6585c862a57e0dedb36fc0922fbe3b386a8cec5ef8c46256ef38e00749eaa53fec7b442be0a390
   languageName: node
   linkType: hard
 
@@ -40034,8 +40032,8 @@ __metadata:
   linkType: hard
 
 "ws@npm:*, ws@npm:^8.11.0, ws@npm:^8.13.0, ws@npm:^8.18.0, ws@npm:^8.18.3, ws@npm:^8.8.0":
-  version: 8.20.0
-  resolution: "ws@npm:8.20.0"
+  version: 8.21.0
+  resolution: "ws@npm:8.21.0"
   peerDependencies:
     bufferutil: ^4.0.1
     utf-8-validate: ">=5.0.2"
@@ -40044,7 +40042,7 @@ __metadata:
       optional: true
     utf-8-validate:
       optional: true
-  checksum: 10c0/956ac5f11738c914089b65878b9223692ace77337ba55379ae68e1ecbeae9b47a0c6eb9403688f609999a58c80d83d99865fe0029b229d308b08c1ef93d4ea14
+  checksum: 10c0/ef4a243476283fc49bc7550966c4af4aa0eef56273837211e700de3b664e08604a760cdddcb5ba43c049140e74ccfec5b0ee0bb439e08c2adf9138902fdde5f9
   languageName: node
   linkType: hard