From 3bd1f82d2e7ab6c797b386c9a6257033eac5d8be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Charles-Edouard=20Br=C3=A9t=C3=A9ch=C3=A9?=
<charled.breteche@gmail.com>
Date: Tue, 13 Dec 2022 21:30:36 +0100
Subject: [PATCH] fix: case where deny message is not a string (#5678)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---
pkg/engine/validation.go | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/pkg/engine/validation.go b/pkg/engine/validation.go
index 8e9d1f6452..f11bc06729 100644
--- a/pkg/engine/validation.go
+++ b/pkg/engine/validation.go
@@ -430,18 +430,20 @@ func (v *validator) getDenyMessage(deny bool) string {
if !deny {
return fmt.Sprintf("validation rule '%s' passed.", v.rule.Name)
}
-
msg := v.rule.Validation.Message
if msg == "" {
return fmt.Sprintf("validation error: rule %s failed", v.rule.Name)
}
-
raw, err := variables.SubstituteAll(v.log, v.policyContext.jsonContext, msg)
if err != nil {
return msg
}
-
- return raw.(string)
+ switch typed := raw.(type) {
+ case string:
+ return typed
+ default:
+ return "the produced message didn't resolve to a string, check your policy definition."
+ }
}
func getSpec(v *validator) (podSpec *corev1.PodSpec, metadata *metav1.ObjectMeta, err error) {