Skip to content

fix(dynamicpathdetector): include Internal in endpoint merge key#24

Merged
entlein merged 1 commit intomainfrom
fix/endpoint-merge-internal-field
Apr 29, 2026
Merged

fix(dynamicpathdetector): include Internal in endpoint merge key#24
entlein merged 1 commit intomainfrom
fix/endpoint-merge-internal-field

Conversation

@entlein
Copy link
Copy Markdown

@entlein entlein commented Apr 29, 2026

HTTPEndpoint.Equal distinguishes endpoints by (Endpoint, Direction, Internal), but MergeDuplicateEndpoints was keying only on (Endpoint, Direction). Three places leaked the bug:

  1. getEndpointKey — duplicate-detection at the top of the loop would collapse two endpoints that differ only in Internal.
  2. The wildcard-after-specific sweep — a :0/x Internal=false wildcard could absorb a previously-recorded :443/x Internal=true sibling because the sweep only checked path + direction.
  3. The wildcardKey lookup for specific-after-wildcard ordering — same omission, so a specific-port entry could fold into a wildcard with a different Internal.

Result: profile entries that the runtime semantically considers distinct (Internal=true vs false) were silently merged into one, losing the internal/external distinction for that path.

Fix: include Internal in getEndpointKey, the sweep predicate, and wildcardKey, all keyed identically so the map lookups stay consistent.

4 new regression tests pin all three spots plus a positive sanity check that matching-Internal merges still happen. Existing tests unchanged.

Flagged on upstream review of kubescape#316.

Sorry, we do not accept changes directly against this repository. Please see
CONTRIBUTING.md for information on where and how to contribute instead.

HTTPEndpoint.Equal distinguishes endpoints by (Endpoint, Direction,
Internal), but MergeDuplicateEndpoints was keying only on
(Endpoint, Direction). Three places leaked the bug:

  1. getEndpointKey — duplicate-detection at the top of the loop
     would collapse two endpoints that differ only in Internal.
  2. The wildcard-after-specific sweep — a :0/x Internal=false
     wildcard could absorb a previously-recorded :443/x Internal=true
     sibling because the sweep only checked path + direction.
  3. The wildcardKey lookup for specific-after-wildcard ordering —
     same omission, so a specific-port entry could fold into a
     wildcard with a different Internal.

Result: profile entries that the runtime semantically considers
distinct (Internal=true vs false) were silently merged into one,
losing the internal/external distinction for that path.

Fix: include Internal in getEndpointKey, the sweep predicate, and
wildcardKey, all keyed identically so the map lookups stay
consistent.

4 new regression tests pin all three spots plus a positive sanity
check that matching-Internal merges still happen. Existing tests
unchanged.

Flagged on upstream review of kubescape#316.
@entlein entlein merged commit 352395a into main Apr 29, 2026
2 checks passed
@github-actions
Copy link
Copy Markdown

Summary:

  • License scan: failure
  • Credentials scan: skipped
  • Vulnerabilities scan: skipped
  • Unit test: success
  • Go linting: failure

@entlein entlein deleted the fix/endpoint-merge-internal-field branch April 30, 2026 07:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant