mirror of
https://github.com/cloudflare/cloudflared.git
synced 2026-06-23 04:10:20 +00:00
João "Pisco" Fernandes
9388e7f48c
Remove the DNS over HTTPS (DoH) proxy feature built on CoreDNS due to security vulnerabilities (GO-2025-3942, GO-2026-4289). This removes: - Standalone proxy-dns command (cloudflared proxy-dns) - Tunnel subcommand (cloudflared tunnel proxy-dns) - Proxy-dns flags for tunnel run (--proxy-dns, --proxy-dns-port, etc.) - Config file resolver section support - tunneldns/ package (CoreDNS-based implementation) - Related component tests BREAKING CHANGE: The proxy-dns feature is no longer available. Users should migrate to alternative DNS over HTTPS solutions.
54 lines
2.0 KiB
Bash
Executable File
54 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e -u
|
|
|
|
# Define the file to store the list of vulnerabilities to ignore.
|
|
IGNORE_FILE=".vulnignore"
|
|
|
|
go version
|
|
# Check if the ignored vulnerabilities file exists. If not, create an empty one.
|
|
if [ ! -f "$IGNORE_FILE" ]; then
|
|
touch "$IGNORE_FILE"
|
|
echo "Created an empty file to store ignored vulnerabilities: $IGNORE_FILE"
|
|
echo "# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line." >>"$IGNORE_FILE"
|
|
echo "# You can also add comments on the same line after the ID." >>"$IGNORE_FILE"
|
|
echo "" >>"$IGNORE_FILE"
|
|
fi
|
|
|
|
# Run govulncheck and capture its output.
|
|
VULN_OUTPUT=$(go run -mod=readonly golang.org/x/vuln/cmd/govulncheck@latest ./... || true)
|
|
|
|
# Print the govuln output
|
|
echo "====================================="
|
|
echo "Full Output of govulncheck:"
|
|
echo "====================================="
|
|
echo "$VULN_OUTPUT"
|
|
echo "====================================="
|
|
echo "End of govulncheck Output"
|
|
echo "====================================="
|
|
|
|
# Process the ignore file to remove comments and empty lines.
|
|
# The 'cut' command gets the vulnerability ID and removes anything after the '#'.
|
|
# The 'grep' command filters out empty lines and lines starting with '#'.
|
|
CLEAN_IGNORES=$(grep -v '^\s*#' "$IGNORE_FILE" | cut -d'#' -f1 | sed 's/ //g' | sort -u || true)
|
|
|
|
# Filter out the ignored vulnerabilities.
|
|
UNIGNORED_VULNS=$(echo "$VULN_OUTPUT" | grep 'Vulnerability' || true)
|
|
|
|
# If the list of ignored vulnerabilities is not empty, filter them out.
|
|
if [ -n "$CLEAN_IGNORES" ]; then
|
|
UNIGNORED_VULNS=$(echo "$UNIGNORED_VULNS" | grep -vFf <(echo "$CLEAN_IGNORES") || true)
|
|
fi
|
|
|
|
# If there are any vulnerabilities that were not in our ignore list, print them and exit with an error.
|
|
if [ -n "$UNIGNORED_VULNS" ]; then
|
|
echo "🚨 Found new, unignored vulnerabilities:"
|
|
echo "-------------------------------------"
|
|
echo "$UNIGNORED_VULNS"
|
|
echo "-------------------------------------"
|
|
echo "Exiting with an error. ❌"
|
|
exit 1
|
|
else
|
|
echo "🎉 No new vulnerabilities found. All clear! ✨"
|
|
exit 0
|
|
fi
|