Bug #20271
closed
Safe mode rendering does not correctly prevent using symbol to proc calls
Description
Using methods such as `.each`, a user can pass as an argument a symbol to be called, for example `.each(&:delete)`.
This allows execution of commands that should be blocked by the jail.
A fix proposal in the safemode gem has been suggested: https://github.com/svenfuchs/safemode/pull/23
Once it is merged we should update our version of the gem to the latest one.
Updated by Marek Hulán over 7 years ago
- Category changed from Templates to Security
Updated by Marek Hulán over 7 years ago
This should be probably cherry-picked to all supported Foreman versions.
Updated by
Updated by The Foreman Bot over 7 years ago
- Status changed from New to Ready For Testing
- Assignee set to Tomer Brisker
- Pull request https://github.com/theforeman/foreman/pull/4659 added
Updated by Daniel Lobato Garcia over 7 years ago
- Translation missing: en.field_release set to 276
Updated by Anonymous over 7 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset feb811114bca02dd746f7b275fbf04715b43376f.
Updated by Alex Fisher over 7 years ago
This possibly should be reopened until https://github.com/theforeman/community-templates/issues/406 is resolved.
Updated by Daniel Lobato Garcia over 7 years ago
The fix is fine, on nightly it prevents using &: . The linked GH issue with templates not being 'aware' of this fix is a different thing.
Updated by The Foreman Bot over 7 years ago
- Pull request https://github.com/theforeman/community-templates/pull/407 added
Updated by The Foreman Bot over 7 years ago
- Pull request https://github.com/theforeman/foreman/pull/4669 added
Updated by The Foreman Bot over 7 years ago
- Pull request https://github.com/theforeman/community-templates/pull/411 added
Updated by Marek Hulán about 7 years ago
- Copied to Bug #20836: Safe mode rendering does not correctly prevent using symbol to proc calls added