djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wip008

Browse Source 
Signed-off-by: Monis Khan <mok@vmware.com>
This commit is contained in:
Monis Khan 2022-07-20 21:58:47 -04:00
parent 41eafd1bdc
commit 5589dcd3b3
No known key found for this signature in database
GPG Key ID: 52C90ADA01B269B8
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
internal/registry/clientsecretrequest/rest.go
View File

@ -144,9 +144,12 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
hashes = []string{hashes[0]}
}
// TODO do not let them have more than 100? secrets
if req.Spec.GenerateNewSecret || needsRevoke {
// each bcrypt comparison is expensive and we do not want a large list to cause wasted CPU
if len(hashes) > 5 {
return nil, apierrors.NewRequestEntityTooLargeError(fmt.Sprintf("OIDCClient %s has too many secrets, spec.revokeOldSecrets must be true", oidcClient.Name))
}
if err := r.secretStorage.Set(ctx, rv, oidcClient.Name, oidcClient.UID, hashes); err != nil {
return nil, err // TODO obfuscate, also return good errors for cases like when the secret now exists but previously did not
}