Safe mode rendering does not correctly prevent using symbol to proc calls
|Assigned To:||Tomer Brisker|
|Found in release:||Pull request:||https://github.com/theforeman/foreman/pull/4659, https://github.com/theforeman/foreman/pull/4669, https://github.com/theforeman/community-templates/pull/411, https://github.com/theforeman/community-templates/pull/407|
|Velocity based estimate||-|
Using methods such as `.each`, a user can pass as an argument a symbol to be called, for example `.each(&:delete)`.
This allows execution of commands that should be blocked by the jail.
A fix proposal in the safemode gem has been suggested: https://github.com/svenfuchs/safemode/pull/23
Once it is merged we should update our version of the gem to the latest one.
#7 Updated by Alex Fisher about 1 month ago
This possibly should be reopened until https://github.com/theforeman/community-templates/issues/406 is resolved.