### CVE-2022-3162: Unauthorized read of Custom Resources

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3

        // Set a system property
        System.setProperty("test.prop", "test.value");

        execJob.testCreateSystemProperties(cmdList, propFile);

        assertTrue(propFile.exists());

        // Read and verify properties
        Properties props = new Properties();
        try (var in = Files.newInputStream(propFile.toPath())) {
            props.load(in);

   *     RuntimeException(e)}. But consider whether users would be better off if your API threw a
   *     different type of exception. For background on the deprecation, read <a
   *     href="https://github.com/google/guava/wiki/Why-we-deprecated-Throwables.propagate">Why we
   *     deprecated {@code Throwables.propagate}</a>.
   */
  @CanIgnoreReturnValue
  @J2ktIncompatible

 * subtype of {@code ValueGraph} that provides methods for adding and removing nodes and edges. If
 * you do not need to mutate a graph (e.g. if you write a method than runs a read-only algorithm on
 * the graph), you should use the non-mutating {@link ValueGraph} interface, or an {@link
 * ImmutableValueGraph}.
 *
 * <p>You can create an immutable copy of an existing {@code ValueGraph} using {@link

 * ({@code [ ]}) indicates that the range is closed on that side; a parenthesis ({@code ( )}) means
 * it is either open or unbounded. The construct {@code {x | statement}} is read "the set of all
 * <i>x</i> such that <i>statement</i>.")
 *
 * <blockquote>
 *
 * <table>
 * <caption>Range Types</caption>
 * <tr><th>Notation        <th>Definition               <th>Factory method

                        currentUrl = processRequest(paramMap, localDataMap, currentUrl, client);
                        if (currentUrl == null) {
                            break;
                        }
                        localDataMap.put(fessConfig.getIndexFieldUrl(), currentUrl);
                        crawlerStatsHelper.record(keyObj, StatsAction.REDIRECTED);
                    }

    assertThat(verifier.verify("a.b.foo.com", session)).isFalse()
  }

  @Test fun verifyWilcardCnOnTld() {
    // It's the CA's responsibility to not issue broad-matching certificates!
    // CN=*.co.jp
    val session =
      session(
        """
        -----BEGIN CERTIFICATE-----
        MIIERjCCAy6gAwIBAgIJAIz+EYMBU6aVMA0GCSqGSIb3DQEBBQUAMIGiMQswCQYD

      ImmutableList.Builder<Method> builder = ImmutableList.builder();
      for (Class<?> type : TypeToken.of(cls).getTypes().rawTypes()) {
        if (!Reflection.getPackageName(type).equals(visiblePackage)) {
          break;
        }
        for (Method method : type.getDeclaredMethods()) {
          if (!method.isSynthetic() && isVisible(method)) {
            builder.add(method);
          }
        }
      }

                readerPropsField.setAccessible(true);
                readerPropsField.set(reader, props);

                org.dbflute.helper.jprop.JavaPropertiesResult result = reader.read();
                propField.set(this, result);
            } catch (Exception e) {
                // Fallback: ignore initialization errors since we override methods anyway
            }
        }
    }

 * while adding a new pair.
 *
 * <p>This class is not threadsafe when any concurrent operations update the multimap, even if the
 * underlying map and {@link #createCollection()} method return threadsafe classes. Concurrent read
 * operations will work correctly. To allow concurrent update operations, wrap your multimap with a
 * call to {@link Multimaps#synchronizedMultimap}.
 *