validateExpirationInExpression validates the IAM policy expression. Currently only validate the following expression: * request.time < timestamp("2021-01-01T00:00:00Z") Other expressions will be ignored.
(expr string, maximumRequestExpiration *durationpb.Duration)
| 1171 | // |
| 1172 | // Other expressions will be ignored. |
| 1173 | func validateExpirationInExpression(expr string, maximumRequestExpiration *durationpb.Duration) error { |
| 1174 | if maximumRequestExpiration == nil { |
| 1175 | return nil |
| 1176 | } |
| 1177 | if !strings.Contains(expr, "request.time") { |
| 1178 | return errors.Errorf("request.time is required") |
| 1179 | } |
| 1180 | e, err := cel.NewEnv() |
| 1181 | if err != nil { |
| 1182 | return errors.Wrap(err, "failed to create cel environment") |
| 1183 | } |
| 1184 | ast, iss := e.Parse(expr) |
| 1185 | if iss != nil { |
| 1186 | return errors.Wrap(iss.Err(), "failed to parse expression") |
| 1187 | } |
| 1188 | |
| 1189 | var validator func(expr celast.Expr) error |
| 1190 | |
| 1191 | validator = func(expr celast.Expr) error { |
| 1192 | switch expr.Kind() { |
| 1193 | case celast.CallKind: |
| 1194 | functionName := expr.AsCall().FunctionName() |
| 1195 | switch functionName { |
| 1196 | case "_||_": |
| 1197 | for _, arg := range expr.AsCall().Args() { |
| 1198 | err := validator(arg) |
| 1199 | if err != nil { |
| 1200 | return err |
| 1201 | } |
| 1202 | } |
| 1203 | return nil |
| 1204 | case "_&&_": |
| 1205 | for _, arg := range expr.AsCall().Args() { |
| 1206 | err := validator(arg) |
| 1207 | if err != nil { |
| 1208 | return err |
| 1209 | } |
| 1210 | } |
| 1211 | return nil |
| 1212 | // Only handle "request.time < timestamp("2021-01-01T00:00:00Z"). |
| 1213 | case "_<_": |
| 1214 | var value string |
| 1215 | for _, arg := range expr.AsCall().Args() { |
| 1216 | switch arg.Kind() { |
| 1217 | case celast.SelectKind: |
| 1218 | variable := fmt.Sprintf("%s.%s", arg.AsSelect().Operand().AsIdent(), arg.AsSelect().FieldName()) |
| 1219 | if variable != "request.time" { |
| 1220 | return errors.Errorf("unexpected variable %v", variable) |
| 1221 | } |
| 1222 | case celast.CallKind: |
| 1223 | functionName := arg.AsCall().FunctionName() |
| 1224 | if functionName != "timestamp" { |
| 1225 | return errors.Errorf("unexpected function %v", functionName) |
| 1226 | } |
| 1227 | if len(arg.AsCall().Args()) != 1 { |
| 1228 | return errors.Errorf("unexpected number of arguments %d", len(arg.AsCall().Args())) |
| 1229 | } |
| 1230 | valueArg := arg.AsCall().Args()[0] |