Tim Gross ffb83e1ef1 client/template: configuration for function blacklist and sandboxing ...

When rendering a task template, the `plugin` function is no longer
permitted by default and will raise an error. An operator can opt-in
to permitting this function with the new `template.function_blacklist`
field in the client configuration.

When rendering a task template, path parameters for the `file`
function will be treated as relative to the task directory by
default. Relative paths or symlinks that point outside the task
directory will raise an error. An operator can opt-out of this
protection with the new `template.disable_file_sandbox` field in the
client configuration.

2019-08-12 16:34:48 -04:00

32 KiB

Raw Blame History

View Raw