xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.83.0` → `v1.83.1` |  |  |
---
### Release Notes
<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>
### [`v1.83.1`](https://github.com/grpc/grpc-go/releases/tag/v1.83.1): Release 1.83.1
[Compare Source](https://github.com/grpc/grpc-go/compare/v1.83.0...v1.83.1)
### Security
- xds/rbac: Fix a bug where nested `Principal` or `Permission` rules with `:scheme` or `grpc-` prefixed header matchers were not rejected, which could cause DENY rules to fail open. ([#​9258](https://github.com/grpc/grpc-go/issues/9258))
- Special Thanks: [@​nvxbug](https://github.com/nvxbug)
- xds/rbac: Fix a bug where the `host` header matcher was not being replaced with `:authority` in nested `Principal` or `Permission` rules. ([#​9258](https://github.com/grpc/grpc-go/issues/9258))
- Special Thanks: [@​nvxbug](https://github.com/nvxbug)
- xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. ([#​9332](https://github.com/grpc/grpc-go/issues/9332))
- Special Thanks: [@​alimony](https://github.com/alimony)
- xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. ([#​9332](https://github.com/grpc/grpc-go/issues/9332))
- Special Thanks: [@​alimony](https://github.com/alimony)
- xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. ([#​9332](https://github.com/grpc/grpc-go/issues/9332))
- Special Thanks: [@​alimony](https://github.com/alimony)
### Performance
- transport: Restrict memory overhead of buffering small data frames. ([#​9331](https://github.com/grpc/grpc-go/issues/9331))
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45LjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC45LjIiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOlsiYXV0b21hdGVkIiwiZGVwZW5kZW5jaWVzIl19-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v1.83.0→v1.83.1Release Notes
grpc/grpc-go (google.golang.org/grpc)
v1.83.1: Release 1.83.1Compare Source
Security
PrincipalorPermissionrules with:schemeorgrpc-prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)hostheader matcher was not being replaced with:authorityin nestedPrincipalorPermissionrules. (#9258)X-Role, matched no header, which could cause DENY rules to fail open. (#9332):schemeorgrpc-prefixed header matcher was accepted when its name was not lowercase. (#9332)Hostheader matcher was not replaced with:authority. (#9332)Performance
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.