frontend: AuthVisible: Validate verb before auth check

This change validates the authVerb passed into the AuthVisible component before calling getAuthorization(), which prevents components from rendering with an invalid verb. Fixes: #2147 Signed-off-by: Evangelos Skopelitis <[email protected]>
headlamp-k8s · Nov 26, 2024 · 98053b2 · 98053b2
1 parent 34bc552
commit 98053b2
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/frontend/src/components/common/Resource/AuthVisible.tsx b/frontend/src/components/common/Resource/AuthVisible.tsx
@@ -3,6 +3,18 @@ import React, { useEffect } from 'react';
 import { KubeObject } from '../../../lib/k8s/KubeObject';
 import { KubeObjectClass } from '../../../lib/k8s/KubeObject';
 
+/** List of valid request verbs. See https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb. */
+const VALID_AUTH_VERBS = [
+  'create',
+  'get',
+  'list',
+  'watch',
+  'update',
+  'patch',
+  'delete',
+  'deletecollection',
+];
+
 export interface AuthVisibleProps extends React.PropsWithChildren<{}> {
   /** The item for which auth will be checked or a resource class (e.g. Job). */
   item: KubeObject | KubeObjectClass | null;
@@ -27,6 +39,12 @@ export interface AuthVisibleProps extends React.PropsWithChildren<{}> {
  */
 export default function AuthVisible(props: AuthVisibleProps) {
   const { item, authVerb, subresource, namespace, onError, onAuthResult, children } = props;
+
+  if (!VALID_AUTH_VERBS.includes(authVerb)) {
+    console.warn(`Invalid authVerb provided: "${authVerb}". Skipping authorization check.`);
+    return null;
+  }
+
   const { data } = useQuery<any>({
     enabled: !!item,
     queryKey: ['authVisible', item, authVerb, subresource, namespace],