李建琦
6d655c9903
Release / update-version (push) Has been cancelled
Release / build-frontend (push) Has been cancelled
Release / release (push) Has been cancelled
Release / sync-version-file (push) Has been cancelled
CI / shell (push) Canceled after 0s
CI / test (push) Canceled after 0s
CI / frontend (push) Canceled after 0s
CI / golangci-lint (push) Canceled after 0s
Security Scan / backend-security (push) Canceled after 0s
Security Scan / frontend-security (push) Canceled after 0s
45 lines
996 B
Bash
Executable File
45 lines
996 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
|
|
cd "$repo_root"
|
|
|
|
check_application_security_opt() {
|
|
file=$1
|
|
count=$(
|
|
awk '
|
|
$0 == " sub2api:" {
|
|
in_application = 1
|
|
next
|
|
}
|
|
in_application && $0 ~ /^ [A-Za-z0-9_-]+:$/ {
|
|
in_application = 0
|
|
}
|
|
in_application && $0 == " security_opt:" {
|
|
in_security_opt = 1
|
|
next
|
|
}
|
|
in_application && in_security_opt && $0 == " - no-new-privileges:true" {
|
|
count++
|
|
}
|
|
END { print count + 0 }
|
|
' "$file"
|
|
)
|
|
|
|
if [ "$count" -ne 1 ]; then
|
|
printf '%s must enable no-new-privileges exactly once for the sub2api service\n' "$file" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
for compose_file in \
|
|
deploy/docker-compose.yml \
|
|
deploy/docker-compose.local.yml \
|
|
deploy/docker-compose.standalone.yml \
|
|
deploy/docker-compose.dev.yml
|
|
do
|
|
check_application_security_opt "$compose_file"
|
|
done
|
|
|
|
printf 'docker compose security test passed\n'
|