Repository navigation
fix(splunk): make the integration actually work (secret-save, docker net, index) - #152
Merged
Merged
Conversation
- blocking: saving an integration wrote the MASKED secret back over the real one (GET returns secrets masked, the UI echoes them on save) — corrupting the splunk token/hec_token (and smtp password) so auth died. keep the stored secret when the incoming value is just its mask (_merge_preserving_secrets). - docker: rewrite localhost/127.0.0.1 -> host.docker.internal for SPLUNK_HOST/ SPLUNK_HEC_URL (we already do this for db/es) so a host/compose splunk is reachable from the runner's bridge network. - splunk_index was accepted everywhere but never applied to the search; scope the SPL to it when the query doesn't already pin an index. tests: secret-merge round-trip + index scoping. 52 splunk/runner tests pass.
splunk_index is user-controlled (models:write) and was interpolated into the SPL unescaped. restrict it to [A-Za-z0-9_-] and reject anything else; add rejection tests and a docs note on the index field.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
makes the splunk integration actually work for a real operator. targets
develop(follow-up to the splunk work in #151).token/hec_token(and smtppassword) and auth died. now the backend keeps the stored secret when the incoming value is just its mask.localhost/127.0.0.1→host.docker.internalforSPLUNK_HOST/SPLUNK_HEC_URL(we already do this for db/es) so a host- or compose-local splunk is reachable from the runner.splunk_indexwas accepted but never applied to the search — now it scopes the SPL when the query doesn't already pin an index.tested: secret-merge round-trip + index scoping, 52 splunk/runner tests green. SSRF guard / HEC output / REST search were verified correct and untouched.
follow-ups (separate, not here): forward-anomalies toggle shows on but saves off until toggled; docker infer double-persists anomalies (runner + orchestrator).