public_git/helmfile
1
0
Fork 0
mirror of https://github.com/helmfile/helmfile.git synced 2026-10-19 11:07:24 +02:00
Code Issues Projects Releases Wiki Activity

feat: support disabling insecure template functions only (#2689)

Browse Source 
Signed-off-by: fabiobaiao <53570695+fabiobaiao@users.noreply.github.com>
This commit is contained in:
fabiobaiao
2026-07-17 17:52:59 +08:00
committed by GitHub
parent d7f9b098ed
commit 919aa29f15
3 changed files with 33 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tmpl/context_funcs.go
+11 -10
View File
@@ -24,22 +24,23 @@ import (
type Values = map[string]any
var DisableInsecureFeaturesErr = DisableInsecureFeaturesError{envvar.DisableInsecureFeatures + " is active, insecure function calls are disabled"}
var DisableInsecureFunctionsErr = DisableInsecureFunctionsError{envvar.DisableInsecureFeatures + " or " + envvar.DisableInsecureTemplateFunctions + " is active, insecure function calls are disabled"}
type DisableInsecureFeaturesError struct {
type DisableInsecureFunctionsError struct {
err string
}
func (e DisableInsecureFeaturesError) Error() string {
func (e DisableInsecureFunctionsError) Error() string {
return e.err
}
var (
disableInsecureFeatures bool
disableInsecureFeatures, disableInsecureTemplateFunctions bool
)
func init() {
disableInsecureFeatures, _ = strconv.ParseBool(os.Getenv(envvar.DisableInsecureFeatures))
disableInsecureTemplateFunctions, _ = strconv.ParseBool(os.Getenv(envvar.DisableInsecureTemplateFunctions))
}
func (c *Context) createFuncMap() template.FuncMap {
@@ -80,22 +81,22 @@ func (c *Context) createFuncMap() template.FuncMap {
return []fs.DirEntry{}, nil
}
}
if disableInsecureFeatures {
if disableInsecureFeatures || disableInsecureTemplateFunctions {
// disable insecure functions
funcMap["exec"] = func(string, []any, ...string) (string, error) {
return "", DisableInsecureFeaturesErr
return "", DisableInsecureFunctionsErr
}
funcMap["envExec"] = func(map[string]any, string, []any, ...string) (string, error) {
return "", DisableInsecureFeaturesErr
return "", DisableInsecureFunctionsErr
}
funcMap["readFile"] = func(string) (string, error) {
return "", DisableInsecureFeaturesErr
return "", DisableInsecureFunctionsErr
}
funcMap["readDir"] = func(string) ([]string, error) {
return nil, DisableInsecureFeaturesErr
return nil, DisableInsecureFunctionsErr
}
funcMap["readDirEntries"] = func(string) ([]string, error) {
return nil, DisableInsecureFeaturesErr
return nil, DisableInsecureFunctionsErr
}
}