Skip to content

Commit 74c815e

Browse files
modular-magicianmodular-magician
authored
Make type assertions more defensive on the secret manager datasources (#11990) (#20255)
[upstream:61269cf1023057d2a5ba80fa6a1b6e408e4d57a1] Signed-off-by: Modular Magician <[email protected]>
1 parent cca9872 commit 74c815e

File tree

5 files changed

+98
-57
lines changed

5 files changed

+98
-57
lines changed

‎.changelog/11990.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
```release-note:none
2+
```

‎google/services/secretmanager/data_source_secret_manager_secret_version.go

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -70,19 +70,27 @@ func dataSourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta inter
7070
return err
7171
}
7272

73-
fv, err := tpgresource.ParseProjectFieldValue("secrets", d.Get("secret").(string), "project", d, config, false)
73+
dSecret, ok := d.Get("secret").(string)
74+
if !ok {
75+
return fmt.Errorf("wrong type for secret field (%T), expected string", d.Get("secret"))
76+
}
77+
78+
fv, err := tpgresource.ParseProjectFieldValue("secrets", dSecret, "project", d, config, false)
7479
if err != nil {
7580
return err
7681
}
77-
if d.Get("project").(string) != "" && d.Get("project").(string) != fv.Project {
78-
return fmt.Errorf("The project set on this secret version (%s) is not equal to the project where this secret exists (%s).", d.Get("project").(string), fv.Project)
79-
}
8082
project := fv.Project
83+
if dProject, ok := d.Get("project").(string); !ok {
84+
return fmt.Errorf("wrong type for project (%T), expected string", d.Get("project"))
85+
} else if dProject != "" && dProject != project {
86+
return fmt.Errorf("project field value (%s) does not match project of secret (%s).", dProject, project)
87+
}
88+
8189
if err := d.Set("project", project); err != nil {
82-
return fmt.Errorf("Error setting project: %s", err)
90+
return fmt.Errorf("error setting project: %s", err)
8391
}
8492
if err := d.Set("secret", fv.Name); err != nil {
85-
return fmt.Errorf("Error setting secret: %s", err)
93+
return fmt.Errorf("error setting secret: %s", err)
8694
}
8795

8896
var url string
@@ -109,21 +117,26 @@ func dataSourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta inter
109117
UserAgent: userAgent,
110118
})
111119
if err != nil {
112-
return fmt.Errorf("Error retrieving available secret manager secret versions: %s", err.Error())
120+
return fmt.Errorf("error retrieving available secret manager secret versions: %s", err.Error())
113121
}
114122

115123
secretVersionRegex := regexp.MustCompile("projects/(.+)/secrets/(.+)/versions/(.+)$")
116124

117-
parts := secretVersionRegex.FindStringSubmatch(version["name"].(string))
125+
nameValue, ok := version["name"]
126+
if !ok {
127+
return fmt.Errorf("read response didn't contain critical fields. Read may not have succeeded.")
128+
}
129+
130+
parts := secretVersionRegex.FindStringSubmatch(nameValue.(string))
118131
// should return [full string, project number, secret name, version number]
119132
if len(parts) != 4 {
120-
panic(fmt.Sprintf("secret name, %s, does not match format, projects/{{project}}/secrets/{{secret}}/versions/{{version}}", version["name"].(string)))
133+
return fmt.Errorf("secret name, %s, does not match format, projects/{{project}}/secrets/{{secret}}/versions/{{version}}", nameValue.(string))
121134
}
122135

123136
log.Printf("[DEBUG] Received Google SecretManager Version: %q", version)
124137

125138
if err := d.Set("version", parts[3]); err != nil {
126-
return fmt.Errorf("Error setting version: %s", err)
139+
return fmt.Errorf("error setting version: %s", err)
127140
}
128141

129142
url = fmt.Sprintf("%s:access", url)
@@ -135,22 +148,22 @@ func dataSourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta inter
135148
UserAgent: userAgent,
136149
})
137150
if err != nil {
138-
return fmt.Errorf("Error retrieving available secret manager secret version access: %s", err.Error())
151+
return fmt.Errorf("error retrieving available secret manager secret version access: %s", err.Error())
139152
}
140153

141154
if err := d.Set("create_time", version["createTime"].(string)); err != nil {
142-
return fmt.Errorf("Error setting create_time: %s", err)
155+
return fmt.Errorf("error setting create_time: %s", err)
143156
}
144157
if version["destroyTime"] != nil {
145158
if err := d.Set("destroy_time", version["destroyTime"].(string)); err != nil {
146-
return fmt.Errorf("Error setting destroy_time: %s", err)
159+
return fmt.Errorf("error setting destroy_time: %s", err)
147160
}
148161
}
149-
if err := d.Set("name", version["name"].(string)); err != nil {
150-
return fmt.Errorf("Error setting name: %s", err)
162+
if err := d.Set("name", nameValue.(string)); err != nil {
163+
return fmt.Errorf("error setting name: %s", err)
151164
}
152165
if err := d.Set("enabled", true); err != nil {
153-
return fmt.Errorf("Error setting enabled: %s", err)
166+
return fmt.Errorf("error setting enabled: %s", err)
154167
}
155168

156169
data := resp["payload"].(map[string]interface{})
@@ -165,9 +178,9 @@ func dataSourceSecretManagerSecretVersionRead(d *schema.ResourceData, meta inter
165178
secretData = string(payloadData)
166179
}
167180
if err := d.Set("secret_data", secretData); err != nil {
168-
return fmt.Errorf("Error setting secret_data: %s", err)
181+
return fmt.Errorf("error setting secret_data: %s", err)
169182
}
170183

171-
d.SetId(version["name"].(string))
184+
d.SetId(nameValue.(string))
172185
return nil
173186
}

‎google/services/secretmanager/data_source_secret_manager_secret_version_access.go

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -58,19 +58,28 @@ func dataSourceSecretManagerSecretVersionAccessRead(d *schema.ResourceData, meta
5858
return err
5959
}
6060

61-
fv, err := tpgresource.ParseProjectFieldValue("secrets", d.Get("secret").(string), "project", d, config, false)
61+
dSecret, ok := d.Get("secret").(string)
62+
if !ok {
63+
return fmt.Errorf("wrong type for secret field (%T), expected string", d.Get("secret"))
64+
}
65+
66+
fv, err := tpgresource.ParseProjectFieldValue("secrets", dSecret, "project", d, config, false)
6267
if err != nil {
6368
return err
6469
}
65-
if d.Get("project").(string) != "" && d.Get("project").(string) != fv.Project {
66-
return fmt.Errorf("The project set on this secret version (%s) is not equal to the project where this secret exists (%s).", d.Get("project").(string), fv.Project)
67-
}
70+
6871
project := fv.Project
72+
if dProject, ok := d.Get("project").(string); !ok {
73+
return fmt.Errorf("wrong type for project (%T), expected string", d.Get("project"))
74+
} else if dProject != "" && dProject != project {
75+
return fmt.Errorf("project field value (%s) does not match project of secret (%s).", dProject, project)
76+
}
77+
6978
if err := d.Set("project", project); err != nil {
70-
return fmt.Errorf("Error setting project: %s", err)
79+
return fmt.Errorf("error setting project: %s", err)
7180
}
7281
if err := d.Set("secret", fv.Name); err != nil {
73-
return fmt.Errorf("Error setting secret: %s", err)
82+
return fmt.Errorf("error setting secret: %s", err)
7483
}
7584

7685
var url string
@@ -97,25 +106,29 @@ func dataSourceSecretManagerSecretVersionAccessRead(d *schema.ResourceData, meta
97106
UserAgent: userAgent,
98107
})
99108
if err != nil {
100-
return fmt.Errorf("Error retrieving available secret manager secret version access: %s", err.Error())
109+
return fmt.Errorf("error retrieving available secret manager secret version access: %s", err.Error())
101110
}
102111

103-
if err := d.Set("name", resp["name"].(string)); err != nil {
104-
return fmt.Errorf("Error setting name: %s", err)
112+
nameValue, ok := resp["name"]
113+
if !ok {
114+
return fmt.Errorf("read response didn't contain critical fields. Read may not have succeeded.")
115+
}
116+
if err := d.Set("name", nameValue.(string)); err != nil {
117+
return fmt.Errorf("error setting name: %s", err)
105118
}
106119

107120
secretVersionRegex := regexp.MustCompile("projects/(.+)/secrets/(.+)/versions/(.+)$")
108121

109-
parts := secretVersionRegex.FindStringSubmatch(resp["name"].(string))
122+
parts := secretVersionRegex.FindStringSubmatch(nameValue.(string))
110123
// should return [full string, project number, secret name, version number]
111124
if len(parts) != 4 {
112-
panic(fmt.Sprintf("secret name, %s, does not match format, projects/{{project}}/secrets/{{secret}}/versions/{{version}}", resp["name"].(string)))
125+
return fmt.Errorf("secret name, %s, does not match format, projects/{{project}}/secrets/{{secret}}/versions/{{version}}", nameValue.(string))
113126
}
114127

115128
log.Printf("[DEBUG] Received Google SecretManager Version: %q", parts[3])
116129

117130
if err := d.Set("version", parts[3]); err != nil {
118-
return fmt.Errorf("Error setting version: %s", err)
131+
return fmt.Errorf("error setting version: %s", err)
119132
}
120133

121134
data := resp["payload"].(map[string]interface{})
@@ -130,9 +143,9 @@ func dataSourceSecretManagerSecretVersionAccessRead(d *schema.ResourceData, meta
130143
secretData = string(payloadData)
131144
}
132145
if err := d.Set("secret_data", secretData); err != nil {
133-
return fmt.Errorf("Error setting secret_data: %s", err)
146+
return fmt.Errorf("error setting secret_data: %s", err)
134147
}
135148

136-
d.SetId(resp["name"].(string))
149+
d.SetId(nameValue.(string))
137150
return nil
138151
}

‎google/services/secretmanagerregional/data_source_secret_manager_regional_secret_version.go

Lines changed: 37 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -88,38 +88,46 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionRead(d *schema.Resource
8888
}
8989

9090
secretRegex := regexp.MustCompile("projects/(.+)/locations/(.+)/secrets/(.+)$")
91-
parts := secretRegex.FindStringSubmatch(d.Get("secret").(string))
91+
dSecret, ok := d.Get("secret").(string)
92+
if !ok {
93+
return fmt.Errorf("wrong type for secret field (%T), expected string", d.Get("secret"))
94+
}
95+
parts := secretRegex.FindStringSubmatch(dSecret)
9296

9397
var project string
9498

9599
// if reference of the secret is provided in the secret field
96100
if len(parts) == 4 {
97101
// Store values of project to set in state
98102
project = parts[1]
99-
if d.Get("project").(string) != "" && d.Get("project").(string) != parts[1] {
100-
return fmt.Errorf("The project set on this secret version (%s) is not equal to the project where this secret exists (%s).", d.Get("project").(string), parts[1])
103+
if dProject, ok := d.Get("project").(string); !ok {
104+
return fmt.Errorf("wrong type for project (%T), expected string", d.Get("project"))
105+
} else if dProject != "" && dProject != project {
106+
return fmt.Errorf("project field value (%s) does not match project of secret (%s).", dProject, project)
101107
}
102-
if d.Get("location").(string) != "" && d.Get("location").(string) != parts[2] {
103-
return fmt.Errorf("The location set on this secret version (%s) is not equal to the location where this secret exists (%s).", d.Get("location").(string), parts[2])
108+
if dLocation, ok := d.Get("location").(string); !ok {
109+
return fmt.Errorf("wrong type for location (%T), expected string", d.Get("location"))
110+
} else if dLocation != "" && dLocation != parts[2] {
111+
return fmt.Errorf("location field value (%s) does not match location of secret (%s).", dLocation, parts[2])
104112
}
105113
if err := d.Set("location", parts[2]); err != nil {
106-
return fmt.Errorf("Error setting location: %s", err)
114+
return fmt.Errorf("error setting location: %s", err)
107115
}
108116
if err := d.Set("secret", parts[3]); err != nil {
109-
return fmt.Errorf("Error setting secret: %s", err)
117+
return fmt.Errorf("error setting secret: %s", err)
110118
}
111119
} else { // if secret name is provided in the secret field
112120
// Store values of project to set in state
113121
project, err = tpgresource.GetProject(d, config)
114122
if err != nil {
115-
return fmt.Errorf("Error fetching project for Secret: %s", err)
123+
return fmt.Errorf("error fetching project for Secret: %s", err)
116124
}
117-
if d.Get("location").(string) == "" {
118-
return fmt.Errorf("Location must be set when providing only secret name")
125+
if dLocation, ok := d.Get("location").(string); ok && dLocation == "" {
126+
return fmt.Errorf("location must be set when providing only secret name")
119127
}
120128
}
121129
if err := d.Set("project", project); err != nil {
122-
return fmt.Errorf("Error setting project: %s", err)
130+
return fmt.Errorf("error setting project: %s", err)
123131
}
124132

125133
var url string
@@ -148,20 +156,25 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionRead(d *schema.Resource
148156
})
149157

150158
if err != nil {
151-
return fmt.Errorf("Error retrieving available secret manager regional secret versions: %s", err.Error())
159+
return fmt.Errorf("error retrieving available secret manager regional secret versions: %s", err.Error())
160+
}
161+
162+
nameValue, ok := secretVersion["name"]
163+
if !ok {
164+
return fmt.Errorf("read response didn't contain critical fields. Read may not have succeeded.")
152165
}
153166

154167
secretVersionRegex := regexp.MustCompile("projects/(.+)/locations/(.+)/secrets/(.+)/versions/(.+)$")
155-
parts = secretVersionRegex.FindStringSubmatch(secretVersion["name"].(string))
168+
parts = secretVersionRegex.FindStringSubmatch(nameValue.(string))
156169

157170
if len(parts) != 5 {
158-
return fmt.Errorf("secret name, %s, does not match format, projects/{{project}}/locations/{{location}}/secrets/{{secret}}/versions/{{version}}", secretVersion["name"].(string))
171+
return fmt.Errorf("secret name, %s, does not match format, projects/{{project}}/locations/{{location}}/secrets/{{secret}}/versions/{{version}}", nameValue.(string))
159172
}
160173

161174
log.Printf("[DEBUG] Received Google Secret Manager Regional Secret Version: %q", secretVersion)
162175

163176
if err := d.Set("version", parts[4]); err != nil {
164-
return fmt.Errorf("Error setting version: %s", err)
177+
return fmt.Errorf("error setting version: %s", err)
165178
}
166179

167180
url = fmt.Sprintf("%s:access", url)
@@ -174,29 +187,29 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionRead(d *schema.Resource
174187
})
175188

176189
if err != nil {
177-
return fmt.Errorf("Error retrieving available secret manager regional secret version access: %s", err.Error())
190+
return fmt.Errorf("error retrieving available secret manager regional secret version access: %s", err.Error())
178191
}
179192

180193
if err := d.Set("customer_managed_encryption", flattenSecretManagerRegionalRegionalSecretVersionCustomerManagedEncryption(secretVersion["customerManagedEncryption"], d, config)); err != nil {
181-
return fmt.Errorf("Error setting customer_managed_encryption: %s", err)
194+
return fmt.Errorf("error setting customer_managed_encryption: %s", err)
182195
}
183196

184197
if err := d.Set("create_time", secretVersion["createTime"].(string)); err != nil {
185-
return fmt.Errorf("Error setting create_time: %s", err)
198+
return fmt.Errorf("error setting create_time: %s", err)
186199
}
187200

188201
if secretVersion["destroyTime"] != nil {
189202
if err := d.Set("destroy_time", secretVersion["destroyTime"].(string)); err != nil {
190-
return fmt.Errorf("Error setting destroy_time: %s", err)
203+
return fmt.Errorf("error setting destroy_time: %s", err)
191204
}
192205
}
193206

194-
if err := d.Set("name", secretVersion["name"].(string)); err != nil {
195-
return fmt.Errorf("Error setting name: %s", err)
207+
if err := d.Set("name", nameValue.(string)); err != nil {
208+
return fmt.Errorf("error setting name: %s", err)
196209
}
197210

198211
if err := d.Set("enabled", true); err != nil {
199-
return fmt.Errorf("Error setting enabled: %s", err)
212+
return fmt.Errorf("error setting enabled: %s", err)
200213
}
201214

202215
data := resp["payload"].(map[string]interface{})
@@ -211,9 +224,9 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionRead(d *schema.Resource
211224
secretData = string(payloadData)
212225
}
213226
if err := d.Set("secret_data", secretData); err != nil {
214-
return fmt.Errorf("Error setting secret_data: %s", err)
227+
return fmt.Errorf("error setting secret_data: %s", err)
215228
}
216229

217-
d.SetId(secretVersion["name"].(string))
230+
d.SetId(nameValue.(string))
218231
return nil
219232
}

‎google/services/secretmanagerregional/data_source_secret_manager_regional_secret_version_access.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ func dataSourceSecretManagerRegionalRegionalSecretVersionAccessRead(d *schema.Re
7878
if dProject, ok := d.Get("project").(string); !ok {
7979
return fmt.Errorf("wrong type for project (%T), expected string", d.Get("project"))
8080
} else if dProject != "" && dProject != project {
81-
return fmt.Errorf("project field value (%s) does not match project of secret (%s).", d.Get("project").(string), project)
81+
return fmt.Errorf("project field value (%s) does not match project of secret (%s).", dProject, project)
8282
}
8383
if dLocation, ok := d.Get("location").(string); !ok {
8484
return fmt.Errorf("wrong type for location (%T), expected string", d.Get("location"))

0 commit comments

Comments
 (0)