From 2bdd83e0291356168ea8a96d6d89b56a34c9bb7a Mon Sep 17 00:00:00 2001 From: Ryan Petrello Date: Mon, 6 Jul 2020 13:50:33 -0400 Subject: [PATCH] use jinja2.sandbox for credential type injectors --- awx/main/models/credential/__init__.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/awx/main/models/credential/__init__.py b/awx/main/models/credential/__init__.py index 6ba5df45b5..36bb2684ea 100644 --- a/awx/main/models/credential/__init__.py +++ b/awx/main/models/credential/__init__.py @@ -11,7 +11,7 @@ import tempfile from types import SimpleNamespace # Jinja2 -from jinja2 import Template +from jinja2 import sandbox # Django from django.db import models @@ -514,8 +514,11 @@ class CredentialType(CommonModelNameNotUnique): # If any file templates are provided, render the files and update the # special `tower` template namespace so the filename can be # referenced in other injectors + + sandbox_env = sandbox.ImmutableSandboxedEnvironment() + for file_label, file_tmpl in file_tmpls.items(): - data = Template(file_tmpl).render(**namespace) + data = sandbox_env.from_string(file_tmpl).render(**namespace) _, path = tempfile.mkstemp(dir=private_data_dir) with open(path, 'w') as f: f.write(data) @@ -537,14 +540,14 @@ class CredentialType(CommonModelNameNotUnique): except ValidationError as e: logger.error('Ignoring prohibited env var {}, reason: {}'.format(env_var, e)) continue - env[env_var] = Template(tmpl).render(**namespace) - safe_env[env_var] = Template(tmpl).render(**safe_namespace) + env[env_var] = sandbox_env.from_string(tmpl).render(**namespace) + safe_env[env_var] = sandbox_env.from_string(tmpl).render(**safe_namespace) if 'INVENTORY_UPDATE_ID' not in env: # awx-manage inventory_update does not support extra_vars via -e extra_vars = {} for var_name, tmpl in self.injectors.get('extra_vars', {}).items(): - extra_vars[var_name] = Template(tmpl).render(**namespace) + extra_vars[var_name] = sandbox_env.from_string(tmpl).render(**namespace) def build_extra_vars_file(vars, private_dir): handle, path = tempfile.mkstemp(dir = private_dir)