From 4cd7ae0ffebbf4878df3a21f6ee058ff8728737f Mon Sep 17 00:00:00 2001 From: Knative Automation Date: Fri, 20 Mar 2026 01:47:35 +0000 Subject: [PATCH] upgrade to latest dependencies bumping knative.dev/hack c448fdb...7eede7f: > 7eede7f Update community files (# 463) bumping knative.dev/networking 91b576b...001fb59: > 001fb59 Update community files (# 1125) bumping knative.dev/pkg 91e1768...8c68e18: > 8c68e18 Bump google.golang.org/grpc from 1.79.2 to 1.79.3 (# 3339) > 98d5a70 Update community files (# 3336) bumping google.golang.org/grpc 8902ab6...dda86db: > dda86db Change version to 1.79.3 (# 8983) > 72186f1 grpc: enforce strict path checking for incoming requests on the server (# 8981) > 97ca352 Changing version to 1.79.3-dev (# 8954) bumping knative.dev/caching 408629a...0201ecf: > 0201ecf Update community files (# 995) Signed-off-by: Knative Automation --- go.mod | 10 ++-- go.sum | 20 +++---- .../grpc/internal/envconfig/envconfig.go | 16 ++++++ vendor/google.golang.org/grpc/server.go | 57 +++++++++++++------ vendor/google.golang.org/grpc/version.go | 2 +- vendor/modules.txt | 10 ++-- 6 files changed, 78 insertions(+), 37 deletions(-) diff --git a/go.mod b/go.mod index 4e06f763e147..7d7860e78139 100644 --- a/go.mod +++ b/go.mod @@ -28,7 +28,7 @@ require ( golang.org/x/sys v0.42.0 golang.org/x/time v0.10.0 google.golang.org/api v0.198.0 - google.golang.org/grpc v1.79.2 + google.golang.org/grpc v1.79.3 k8s.io/api v0.35.2 k8s.io/apiextensions-apiserver v0.35.2 k8s.io/apimachinery v0.35.2 @@ -36,10 +36,10 @@ require ( k8s.io/code-generator v0.35.2 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 - knative.dev/caching v0.0.0-20260317014950-408629a8fd29 - knative.dev/hack v0.0.0-20260310014051-c448fdb867e2 - knative.dev/networking v0.0.0-20260317015751-91b576b3d619 - knative.dev/pkg v0.0.0-20260317082650-91e176852006 + knative.dev/caching v0.0.0-20260318014239-0201ecf9e8f3 + knative.dev/hack v0.0.0-20260318014029-7eede7fdcbad + knative.dev/networking v0.0.0-20260318014906-001fb594d5a2 + knative.dev/pkg v0.0.0-20260319144801-8c68e18a5cc7 sigs.k8s.io/randfill v1.0.0 sigs.k8s.io/yaml v1.6.0 ) diff --git a/go.sum b/go.sum index 2d8251d0703a..f96152c9304d 100644 --- a/go.sum +++ b/go.sum @@ -492,8 +492,8 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc= -google.golang.org/grpc v1.79.2 h1:fRMD94s2tITpyJGtBBn7MkMseNpOZU8ZxgC3MMBaXRU= -google.golang.org/grpc v1.79.2/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= +google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= @@ -546,14 +546,14 @@ k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZ k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck= k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= -knative.dev/caching v0.0.0-20260317014950-408629a8fd29 h1:uxOxwL84CKl10MflLPV+fErkvVz8LW14ug9u5/SEzl0= -knative.dev/caching v0.0.0-20260317014950-408629a8fd29/go.mod h1:P61LpKUA6h0IeWjWwGwNimd2teheWbgSGsyNIF/tHK4= -knative.dev/hack v0.0.0-20260310014051-c448fdb867e2 h1:b35SGLEp03D8oGf8mE9HBt3yfNgYpAK0fw46hFXs9w4= -knative.dev/hack v0.0.0-20260310014051-c448fdb867e2/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0= -knative.dev/networking v0.0.0-20260317015751-91b576b3d619 h1:Ff71TIn4yIVTWLrDF/SyN0KEJ1LNconyeptgkzZEzAY= -knative.dev/networking v0.0.0-20260317015751-91b576b3d619/go.mod h1:0UAbiLzpmMyhpjWVwRo9vYEWPKGyY6PM2VCKQkBpXE4= -knative.dev/pkg v0.0.0-20260317082650-91e176852006 h1:kigmOSaEWOddCfoyH1+Mx0w1kwnZrl3CbPAN+9/+Kx4= -knative.dev/pkg v0.0.0-20260317082650-91e176852006/go.mod h1:o/XS1E/hYh9IR8deEEiJG4kKtQfqnf9Gwt5bwp2x4AU= +knative.dev/caching v0.0.0-20260318014239-0201ecf9e8f3 h1:yUKRxYHWvid3PUgEB2C+N3aVxtpQwUWWE+oA6zS/hHI= +knative.dev/caching v0.0.0-20260318014239-0201ecf9e8f3/go.mod h1:P61LpKUA6h0IeWjWwGwNimd2teheWbgSGsyNIF/tHK4= +knative.dev/hack v0.0.0-20260318014029-7eede7fdcbad h1:yH957Dv5HrPgllwTs7e1wvCKcjg/PC0QPQGEWkK7QFw= +knative.dev/hack v0.0.0-20260318014029-7eede7fdcbad/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0= +knative.dev/networking v0.0.0-20260318014906-001fb594d5a2 h1:GcSmyeVB/I9BU1dP36M1iDm09lfv9Z48bv/qXu0Yp90= +knative.dev/networking v0.0.0-20260318014906-001fb594d5a2/go.mod h1:0UAbiLzpmMyhpjWVwRo9vYEWPKGyY6PM2VCKQkBpXE4= +knative.dev/pkg v0.0.0-20260319144801-8c68e18a5cc7 h1:CGvCs59CA7mO81TrJpwxD0dLEpWVhfCRyjfHmsP1c6I= +knative.dev/pkg v0.0.0-20260319144801-8c68e18a5cc7/go.mod h1:RdLk2PjzyP79Zsj4no0G8zGHeEq5JzYzP69owy2NiGY= pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw= pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM= diff --git a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go index e8dc791299ea..7ad6fb44ca85 100644 --- a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go +++ b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go @@ -88,6 +88,22 @@ var ( // feature can be disabled by setting the environment variable // GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING to "false". PickFirstWeightedShuffling = boolFromEnv("GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING", true) + + // DisableStrictPathChecking indicates whether strict path checking is + // disabled. This feature can be disabled by setting the environment + // variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING to "true". + // + // When strict path checking is enabled, gRPC will reject requests with + // paths that do not conform to the gRPC over HTTP/2 specification found at + // https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md. + // + // When disabled, gRPC will allow paths that do not contain a leading slash. + // Enabling strict path checking is recommended for security reasons, as it + // prevents potential path traversal vulnerabilities. + // + // A future release will remove this environment variable, enabling strict + // path checking behavior unconditionally. + DisableStrictPathChecking = boolFromEnv("GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING", false) ) func boolFromEnv(envVar string, def bool) bool { diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go index 1b5cefe81715..8efb29a7b95c 100644 --- a/vendor/google.golang.org/grpc/server.go +++ b/vendor/google.golang.org/grpc/server.go @@ -42,6 +42,7 @@ import ( "google.golang.org/grpc/internal" "google.golang.org/grpc/internal/binarylog" "google.golang.org/grpc/internal/channelz" + "google.golang.org/grpc/internal/envconfig" "google.golang.org/grpc/internal/grpcsync" "google.golang.org/grpc/internal/grpcutil" istats "google.golang.org/grpc/internal/stats" @@ -149,6 +150,8 @@ type Server struct { serverWorkerChannel chan func() serverWorkerChannelClose func() + + strictPathCheckingLogEmitted atomic.Bool } type serverOptions struct { @@ -1762,6 +1765,24 @@ func (s *Server) processStreamingRPC(ctx context.Context, stream *transport.Serv return ss.s.WriteStatus(statusOK) } +func (s *Server) handleMalformedMethodName(stream *transport.ServerStream, ti *traceInfo) { + if ti != nil { + ti.tr.LazyLog(&fmtStringer{"Malformed method name %q", []any{stream.Method()}}, true) + ti.tr.SetError() + } + errDesc := fmt.Sprintf("malformed method name: %q", stream.Method()) + if err := stream.WriteStatus(status.New(codes.Unimplemented, errDesc)); err != nil { + if ti != nil { + ti.tr.LazyLog(&fmtStringer{"%v", []any{err}}, true) + ti.tr.SetError() + } + channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream failed to write status: %v", err) + } + if ti != nil { + ti.tr.Finish() + } +} + func (s *Server) handleStream(t transport.ServerTransport, stream *transport.ServerStream) { ctx := stream.Context() ctx = contextWithServer(ctx, s) @@ -1782,26 +1803,30 @@ func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Ser } sm := stream.Method() - if sm != "" && sm[0] == '/' { + if sm == "" { + s.handleMalformedMethodName(stream, ti) + return + } + if sm[0] != '/' { + // TODO(easwars): Add a link to the CVE in the below log messages once + // published. + if envconfig.DisableStrictPathChecking { + if old := s.strictPathCheckingLogEmitted.Swap(true); !old { + channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream received malformed method name %q. Allowing it because the environment variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING is set to true, but this option will be removed in a future release.", sm) + } + } else { + if old := s.strictPathCheckingLogEmitted.Swap(true); !old { + channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream rejected malformed method name %q. To temporarily allow such requests, set the environment variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING to true. Note that this is not recommended as it may allow requests to bypass security policies.", sm) + } + s.handleMalformedMethodName(stream, ti) + return + } + } else { sm = sm[1:] } pos := strings.LastIndex(sm, "/") if pos == -1 { - if ti != nil { - ti.tr.LazyLog(&fmtStringer{"Malformed method name %q", []any{sm}}, true) - ti.tr.SetError() - } - errDesc := fmt.Sprintf("malformed method name: %q", stream.Method()) - if err := stream.WriteStatus(status.New(codes.Unimplemented, errDesc)); err != nil { - if ti != nil { - ti.tr.LazyLog(&fmtStringer{"%v", []any{err}}, true) - ti.tr.SetError() - } - channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream failed to write status: %v", err) - } - if ti != nil { - ti.tr.Finish() - } + s.handleMalformedMethodName(stream, ti) return } service := sm[:pos] diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go index f9da6c6cae36..76c2eed773a2 100644 --- a/vendor/google.golang.org/grpc/version.go +++ b/vendor/google.golang.org/grpc/version.go @@ -19,4 +19,4 @@ package grpc // Version is the current grpc version. -const Version = "1.79.2" +const Version = "1.79.3" diff --git a/vendor/modules.txt b/vendor/modules.txt index a3cfc808db05..954f51c482b4 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -799,7 +799,7 @@ google.golang.org/genproto/googleapis/api/httpbody google.golang.org/genproto/googleapis/rpc/code google.golang.org/genproto/googleapis/rpc/errdetails google.golang.org/genproto/googleapis/rpc/status -# google.golang.org/grpc v1.79.2 +# google.golang.org/grpc v1.79.3 ## explicit; go 1.24.0 google.golang.org/grpc google.golang.org/grpc/attributes @@ -1480,7 +1480,7 @@ k8s.io/utils/lru k8s.io/utils/net k8s.io/utils/ptr k8s.io/utils/trace -# knative.dev/caching v0.0.0-20260317014950-408629a8fd29 +# knative.dev/caching v0.0.0-20260318014239-0201ecf9e8f3 ## explicit; go 1.25.0 knative.dev/caching/config knative.dev/caching/pkg/apis/caching @@ -1501,10 +1501,10 @@ knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image/fake knative.dev/caching/pkg/client/injection/informers/factory knative.dev/caching/pkg/client/injection/informers/factory/fake knative.dev/caching/pkg/client/listers/caching/v1alpha1 -# knative.dev/hack v0.0.0-20260310014051-c448fdb867e2 +# knative.dev/hack v0.0.0-20260318014029-7eede7fdcbad ## explicit; go 1.24 knative.dev/hack -# knative.dev/networking v0.0.0-20260317015751-91b576b3d619 +# knative.dev/networking v0.0.0-20260318014906-001fb594d5a2 ## explicit; go 1.25.0 knative.dev/networking/config knative.dev/networking/pkg/apis/networking @@ -1541,7 +1541,7 @@ knative.dev/networking/pkg/http/proxy knative.dev/networking/pkg/http/stats knative.dev/networking/pkg/ingress knative.dev/networking/pkg/prober -# knative.dev/pkg v0.0.0-20260317082650-91e176852006 +# knative.dev/pkg v0.0.0-20260319144801-8c68e18a5cc7 ## explicit; go 1.25.0 knative.dev/pkg/apiextensions/storageversion knative.dev/pkg/apiextensions/storageversion/cmd/migrate