ansible-collections/community.docker
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.docker.git synced 2026-07-29 11:55:04 +00:00
Code Packages Projects Releases Wiki Activity

Prevent RCE via inventory plugins (#815)

Browse Source 
* Prevent RCE via inventory plugins.

* Do not make ansible_connection unsafe.

* Add test.
This commit is contained in:
Felix Fontein
2024-03-14 20:08:41 +01:00
committed by GitHub
parent 14e2f92974
commit bf1281ae7f
8 changed files with 85 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/inventory/docker_containers.py
+13 -4
View File
@@ -167,6 +167,7 @@ import re
from ansible.errors import AnsibleError
from ansible.module_utils.common.text.converters import to_native
from ansible.plugins.inventory import BaseInventoryPlugin, Constructable
from ansible.utils.unsafe_proxy import wrap_var as make_unsafe
from ansible_collections.community.docker.plugins.module_utils.common_api import (
RequestException,
@@ -239,8 +240,8 @@ class InventoryModule(BaseInventoryPlugin, Constructable):
full_name = id
facts = dict(
docker_name=name,
docker_short_id=short_id
docker_name=make_unsafe(name),
docker_short_id=make_unsafe(short_id),
)
full_facts = dict()
@@ -274,6 +275,7 @@ class InventoryModule(BaseInventoryPlugin, Constructable):
if add_legacy_groups:
groups.append('service_{0}'.format(service_name))
ansible_connection = None
if connection_type == 'ssh':
# Figure out ssh IP and Port
try:
@@ -296,20 +298,27 @@ class InventoryModule(BaseInventoryPlugin, Constructable):
elif connection_type == 'docker-cli':
facts.update(dict(
ansible_host=full_name,
ansible_connection='community.docker.docker',
))
ansible_connection = 'community.docker.docker'
elif connection_type == 'docker-api':
facts.update(dict(
ansible_host=full_name,
ansible_connection='community.docker.docker_api',
))
facts.update(extra_facts)
ansible_connection = 'community.docker.docker_api'
full_facts.update(facts)
for key, value in inspect.items():
fact_key = self._slugify(key)
full_facts[fact_key] = value
full_facts = make_unsafe(full_facts)
if ansible_connection:
for d in (facts, full_facts):
if 'ansible_connection' not in d:
d['ansible_connection'] = ansible_connection
if not filter_host(self, name, full_facts, filters):
continue