Cross-Site Scripting: Reflected found in pkg/tcpproxy/tcp.go about ingress-nginx

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

How can a reader test or reproduce the XSS

[smaniraju]

This issue is reported in static code analysis tools.
The root cause issue is data directly read from connection (tcp.go:65) is being written back pkg/tcpproxy/tcp.go:110 which leads to XSS issues.

[rikatz]

sorry, what static code analysis? How was this detected?

Without a way to reproduce, we cannot accept this issue.

/triage needs-information

[longwuyuan]

/remove-kind bug

[smaniraju]

static-code analysis tools like fortify.

[rikatz]

Sorry, without a proper report and some more information it is not easy to reproduce.

Also this part of the code does tcp stream directly, it is not even related with l7/http proxying so I'm curious how this was identified.

At this point I am closing this issue, if you have some more information, some real report, etc please let me know! Thanks

/close

[k8s-ci-robot]

@rikatz: Closing this issue.

In response to this:

Sorry, without a proper report and some more information it is not easy to reproduce.

Also this part of the code does tcp stream directly, it is not even related with l7/http proxying so I'm curious how this was identified.

At this point I am closing this issue, if you have some more information, some real report, etc please let me know! Thanks

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.