kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-06 18:35:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

sec: remove non-hermetic sprig template functions (#25998)

Browse Source 
* sec:add sprig template functions in denylists

* remove explicit set which is no longer needed

* go mod tidy

* add changelog

* better changelog and filtered denylist

* go mod tidy with 1.24.4

* edit changelog and remove htpasswd and derive

* fix tests

* Update client/allocrunner/taskrunner/template/template_test.go

Co-authored-by: Tim Gross <tgross@hashicorp.com>

* edit changelog

---------

Co-authored-by: Tim Gross <tgross@hashicorp.com>
This commit is contained in:
Deniz Onur Duzgun
2025-06-09 13:00:47 -04:00
committed by GitHub
parent 4bd51942e6
commit abd0efdd76
4 changed files with 52 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
client/allocrunner/taskrunner/template/template_test.go
View File

@@ -2744,3 +2744,31 @@ func TestTaskTemplateManager_writeToFile(t *testing.T) {
must.NoError(t, err)
must.Eq(t, "hello", string(r))
}
func TestTaskTemplateManager_deniedSprig(t *testing.T) {
ci.Parallel(t)
file := "my.tmpl"
template := &structs.Template{
EmbeddedTmpl: `{{ "hello" | sprig_env }}`,
DestPath: file,
ChangeMode: structs.TemplateChangeModeNoop,
}
harness := newTestHarness(t, []*structs.Template{template}, false, false)
must.NoError(t, harness.startWithErr(), must.Sprint("couldn't setup initial harness"))
defer harness.stop()
// Using sprig_env should cause a kill
select {
case <-harness.mockHooks.UnblockCh:
case <-harness.mockHooks.EmitEventCh:
t.Fatalf("Task event should not have been emitted")
case e := <-harness.mockHooks.KillCh:
must.StrContains(t, e.DisplayMessage, "not defined")
case <-time.After(time.Duration(5*testutil.TestMultiplier()) * time.Second):
t.Fatalf("timeout")
}
}