[darkdoc]

Add badge for rhoso pattern

[ocpdocs-previewbot]

🤖 Tue Oct 27 15:25:02 - The preview is ready at:
https://741--patternsdocs-pr.netlify.app

[cjeanner]

I know I can't approve, but I do approve that change :). Thank you @darkdoc !

[openshift-ci]

@cjeanner: changing LGTM is restricted to collaborators

Details

In response to this:

I know I can't approve, but I do approve that change :). Thank you @darkdoc !

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[laubai]

Reviewed and posted question about sanitizing inputs in Slack.

[laubai]

Probably need to sanitize inputs from external sources or add tests to reduce risk, e.g. say the JSON file listed at ci_source changes to include a malicious URL at either patternRepo or pipelineUrl, it doesn't currently look like we could catch that change before our site is updated with it.

[cjeanner]

Probably need to sanitize inputs from external sources or add tests to reduce risk, e.g. say the JSON file listed at ci_source changes to include a malicious URL at either patternRepo or pipelineUrl, it doesn't currently look like we could catch that change before our site is updated with it.

Hey @laubai I'm wondering what are the actual risks there: as far as I know, pipelineUrl isn't used by validatedpattern.io website, is it? Meaning only human would click on that link, provided they open the JSON file. Maybe that specific key shouldn't even be in the badge (neither should the debugInfo imho, since it may point to internal resources).

Regarding the patternRepo, there, yes, a filter ensuring it's hosted under validatedpatterns or validatedpatterns-sandbox org is probably something that should be implemented, though I think it's not the one used to expose the link to the actual pattern either, since sandbox patterns may not have the badge, but are still showing the link to the source repository.

Any thoughts?

[laubai]

@cjeanner The test build doesn't include data/cards, so I wasn't sure about that - just raising out of caution.
In the current site, you can definitely get to the point of seeing pipelineURL and patternRepo values (on vp.io, click Status --> Classic --> click a badge) but we're not waving them in front of people.