dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

Credential references can be resolved and sent to an arbitrary host via Test Connect (Galaxy env:, OpcUaClient secret:) #815

New Issue
Closed
opened 2026-11-11 00:05:56 -05:00 by dohertj2 · 1 comment
dohertj2 commented 2026-11-11 00:05:56 -05:00
Owner
Copy Link
Copy Source

Found by the independent review of #803. A Designer can point a driver/device endpoint at a host they control and set a credential field to any reference the admin node can resolve — e.g. Galaxy env:ConnectionStrings__ConfigDb / env:ServerHistorian__ApiKey, or OpcUaClient secret:<any store entry> — then click Test Connect; the admin node resolves the value and sends it to that host. No deploy is needed.

#803 closed this for Heidenhain by scoping references to secret:heidenhain/<name> / env:OTOPCUA_HEIDENHAIN_<NAME>, enforced in parser, save path, deploy gate, probe and again at resolve time (see docs/drivers/Heidenhain.md). Apply an equivalent per-driver namespace to every driver that resolves secret:/env: references (at least Galaxy and OpcUaClient; audit the rest), with a migration note for existing configs.

Found by the independent review of #803. A Designer can point a driver/device endpoint at a host they control and set a credential field to any reference the admin node can resolve — e.g. Galaxy `env:ConnectionStrings__ConfigDb` / `env:ServerHistorian__ApiKey`, or OpcUaClient `secret:<any store entry>` — then click Test Connect; the admin node resolves the value and sends it to that host. No deploy is needed. #803 closed this for Heidenhain by scoping references to `secret:heidenhain/<name>` / `env:OTOPCUA_HEIDENHAIN_<NAME>`, enforced in parser, save path, deploy gate, probe and again at resolve time (see docs/drivers/Heidenhain.md). Apply an equivalent per-driver namespace to every driver that resolves `secret:`/`env:` references (at least Galaxy and OpcUaClient; audit the rest), with a migration note for existing configs.
dohertj2 added the cross-drivertype:bugpriority:p2 labels 2026-11-11 00:05:56 -05:00
dohertj2 commented 2026-11-11 05:24:29 -05:00
Author
Owner
Copy Link
Copy Source

Fixed on master (e9064dbd, live-gate fix 481985e2). Pushed to master in d1b6cad2. Galaxy/OpcUaClient credential references are confined to driver-type namespaces and refused at save, deploy (CredentialReferenceOutOfScope), Test Connect and browse; running drivers with legacy references keep working with a rate-limited WARN + credential-compat:<field> diagnostics (owner decision: warn-only). CredentialReferencePreflight lists findings on the /raw banner. The docker-dev gate found the preflight's ArtifactBlob.Length > 0 predicate untranslatable on SQL Server (threw every boot) — fixed to read the latest Sealed artifact, with a new [SqlServerFact] test shown to fail on the old predicate. Follow-ups: #834 (remove warn-only), #835, #836 (both fixed in this batch).

Fixed on master (`e9064dbd`, live-gate fix `481985e2`). Pushed to master in `d1b6cad2`. Galaxy/OpcUaClient credential references are confined to driver-type namespaces and refused at save, deploy (`CredentialReferenceOutOfScope`), Test Connect and browse; running drivers with legacy references keep working with a rate-limited WARN + `credential-compat:<field>` diagnostics (owner decision: warn-only). `CredentialReferencePreflight` lists findings on the /raw banner. The docker-dev gate found the preflight's `ArtifactBlob.Length > 0` predicate untranslatable on SQL Server (threw every boot) — fixed to read the latest Sealed artifact, with a new `[SqlServerFact]` test shown to fail on the old predicate. Follow-ups: #834 (remove warn-only), #835, #836 (both fixed in this batch).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label cross-driver priority:p2 type:bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#815
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?