Project

General

Profile

Actions

Bug #20836

closed

Safe mode rendering does not correctly prevent using symbol to proc calls

Added by Marek Hulán about 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
High
Assignee:
Category:
-
Target version:
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

Using methods such as `.each`, a user can pass as an argument a symbol to be called, for example `.each(&:delete)`.
This allows execution of commands that should be blocked by the jail.
A fix proposal in the safemode gem has been suggested: https://github.com/svenfuchs/safemode/pull/23
Once it is merged we should update our version of the gem to the latest one.

All of the above already happened, templates must be updated in order to work with the safemode gem version 1.3.2+, I think this should be cherry-picked to 3.4-stable


Related issues 3 (0 open3 closed)

Has duplicate Katello - Bug #20753: After upgrade to latest version katello 3.4.5 the default templates still broken RejectedJustin Sherrill08/28/2017Actions
Has duplicate Katello - Bug #21406: Remove to_proc syntax from Katello Kickstart DefaultDuplicate10/20/2017Actions
Copied from Foreman - Bug #20271: Safe mode rendering does not correctly prevent using symbol to proc callsClosedTomer Brisker07/11/2017Actions
Actions

Also available in: Atom PDF