Bug #20271
closed
Safe mode rendering does not correctly prevent using symbol to proc calls
Added by Tomer Brisker over 7 years ago.
Updated over 6 years ago.
Description
Using methods such as `.each`, a user can pass as an argument a symbol to be called, for example `.each(&:delete)`.
This allows execution of commands that should be blocked by the jail.
A fix proposal in the safemode gem has been suggested: https://github.com/svenfuchs/safemode/pull/23
Once it is merged we should update our version of the gem to the latest one.
- Category changed from Templates to Security
This should be probably cherry-picked to all supported Foreman versions.
- Bugzilla link set to 1469599
- Status changed from New to Ready For Testing
- Assignee set to Tomer Brisker
- Pull request https://github.com/theforeman/foreman/pull/4659 added
- Translation missing: en.field_release set to 276
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
The fix is fine, on nightly it prevents using &: . The linked GH issue with templates not being 'aware' of this fix is a different thing.
- Pull request https://github.com/theforeman/community-templates/pull/407 added
- Pull request https://github.com/theforeman/foreman/pull/4669 added
- Pull request https://github.com/theforeman/community-templates/pull/411 added
- Copied to Bug #20836: Safe mode rendering does not correctly prevent using symbol to proc calls added
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by Anonymous 
Updated by