Alertmanager: reject global mattermost_webhook_url_file - #7768
Merged
Merged
Conversation
validateGlobalConfig checks ten global *_file settings but omitted MattermostWebhookURLFile, the only one missing. This was not exploitable. When a mattermost receiver is present, upstream copies the global value into the receiver's WebhookURLFile during unmarshal (config.go:637), which happens inside config.Load and therefore before validateAlertmanagerConfig runs, so validateMattermostConfig already rejected it. With no mattermost receiver the global value was accepted but never propagated, and nothing read it. The coverage was accidental though: it depends entirely on upstream doing that propagation in UnmarshalYAML. If that ever moves into the notifier constructor the check silently stops working. Validate the field directly so the guarantee does not rest on upstream ordering. Reuse the existing error and extend its message to name both settings, matching how slack_api_url_file, rocketchat_token_file and the other dual-scope settings are reported. Signed-off-by: Friedrich Gonzalez <1517449+friedrichg@users.noreply.github.com>
Signed-off-by: Friedrich Gonzalez <1517449+friedrichg@users.noreply.github.com>
friedrichg
force-pushed
the
global-mattermost-file
branch
from
August 14, 2026 22:40
fef55d2 to
8bdafbd
Compare
CharlieTLe
added a commit
to CharlieTLe/cortex
that referenced
this pull request
Sep 2, 2026
Get the unreleased section into the shape RELEASE.md asks for before the release-1.22 cut, so operators reading the notes see the changes that affect them: - Delete the stale duplicate of cortexproject#7375, which already shipped in 1.21.0 as cortexproject#7370. - Re-sort into CHANGE -> FEATURE -> ENHANCEMENT -> BUGFIX. - Correct the gRPC entry: the bump landed at v1.82.1, not v1.79.3. - Fold follow-up PRs into the entry they belong to. - Add three missing user-facing entries: cortexproject#7513, cortexproject#7514 and cortexproject#7559. - Reclassify as CHANGE the entries that break existing configs or log consumers: the sign-key validation (cortexproject#7587), the Alertmanager per-tenant *_file rejections (cortexproject#7767, cortexproject#7768, now one entry) and the time_taken -> time_taken_ms rename (cortexproject#7649). - Note the operator impact of the distroless base image (cortexproject#7637) and of the 500 -> 499 reclassification (cortexproject#7717). Rebased onto master, which added eight entries after this was first written. They are curated the same way: - Sorted into their categories: the deprecated flag removal (cortexproject#7790) and the max-exemplars deprecation (cortexproject#7793) under CHANGE, the X-Grafana-User query log (cortexproject#7799) under ENHANCEMENT, the YAML zero-value validation (cortexproject#7700) and the ReadPartitionedGroupInfo error handling (cortexproject#7766) under BUGFIX. - Folded the Go toolchain bump (cortexproject#7807, cortexproject#7814) into the existing build image entry, which now reads 1.27.0 rather than carrying a second entry for it. - Folded cortexproject#7745 into cortexproject#7698: both are the same wipe-on-transient-DNS-failure bug, cortexproject#7698 on the A record path and cortexproject#7745 on the SRV path. - Folded cortexproject#7743 into cortexproject#7640: both are panics in the active request tracker's truncation of match[]/query values. Signed-off-by: Charlie Le <charlie_le@apple.com>
CharlieTLe
added a commit
to CharlieTLe/cortex
that referenced
this pull request
Sep 11, 2026
Get the unreleased section into the shape RELEASE.md asks for before the release-1.22 cut, so operators reading the notes see the changes that affect them: - Delete the stale duplicate of cortexproject#7375, which already shipped in 1.21.0 as cortexproject#7370. - Re-sort into CHANGE -> FEATURE -> ENHANCEMENT -> BUGFIX. - Correct the gRPC entry: the bump landed at v1.82.1, not v1.79.3. - Fold follow-up PRs into the entry they belong to. - Add three missing user-facing entries: cortexproject#7513, cortexproject#7514 and cortexproject#7559. - Reclassify as CHANGE the entries that break existing configs or log consumers: the sign-key validation (cortexproject#7587), the Alertmanager per-tenant *_file rejections (cortexproject#7767, cortexproject#7768, now one entry) and the time_taken -> time_taken_ms rename (cortexproject#7649). - Note the operator impact of the distroless base image (cortexproject#7637) and of the 500 -> 499 reclassification (cortexproject#7717). Rebased onto master, which added eight entries after this was first written. They are curated the same way: - Sorted into their categories: the deprecated flag removal (cortexproject#7790) and the max-exemplars deprecation (cortexproject#7793) under CHANGE, the X-Grafana-User query log (cortexproject#7799) under ENHANCEMENT, the YAML zero-value validation (cortexproject#7700) and the ReadPartitionedGroupInfo error handling (cortexproject#7766) under BUGFIX. - Folded the Go toolchain bump (cortexproject#7807, cortexproject#7814) into the existing build image entry, which now reads 1.27.0 rather than carrying a second entry for it. - Folded cortexproject#7745 into cortexproject#7698: both are the same wipe-on-transient-DNS-failure bug, cortexproject#7698 on the A record path and cortexproject#7745 on the SRV path. - Folded cortexproject#7743 into cortexproject#7640: both are panics in the active request tracker's truncation of match[]/query values. Rebased again onto master, which added eight more entries. Same treatment: - Sorted into their categories: the evaluation-delay-duration removal (cortexproject#7792) and the fifocache/ingester-metadata-streaming removals (cortexproject#7791) under CHANGE, the parquet max-block-label-names limit (cortexproject#7625), the non-pointer HistogramBucket slice (cortexproject#7809) and the merge iterator BatchSize (cortexproject#7823) under ENHANCEMENT, and the CSV-list empty-string fix (cortexproject#7714) under BUGFIX. - Folded the Thanos/promql-engine refresh (cortexproject#7788) into the existing upgrade entry, which already carries cortexproject#7691, cortexproject#7505 and cortexproject#7740. Signed-off-by: Charlie Le <charlie_le@apple.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does: Adds
mattermost_webhook_url_fileto the global*_filechecks invalidateGlobalConfig, the only one of the eleven that was missing.Not exploitable today. When a mattermost receiver is present, upstream copies the global value into the receiver's
WebhookURLFileduring unmarshal, which runs before validation, so the per-receiver check already rejected it. With no mattermost receiver the value was accepted but never read.The coverage was accidental though, resting entirely on upstream doing that propagation in
UnmarshalYAML. Validating the field directly means the guarantee no longer depends on upstream ordering.Reuses the existing error and extends its message to name both settings, matching how the other dual-scope settings are reported.
Found while auditing every file-path field reachable from a tenant config; the other 42 are all rejected.
CHANGELOG entry needs a PR number.