public_git/helmfile
1
0
Fork 0
mirror of https://github.com/helmfile/helmfile.git synced 2026-10-19 11:07:24 +02:00
Code Issues Projects Releases Wiki Activity

feat: support disabling insecure template functions only (#2689)

Browse Source 
Signed-off-by: fabiobaiao <53570695+fabiobaiao@users.noreply.github.com>
This commit is contained in:
fabiobaiao
2026-07-17 17:52:59 +08:00
committed by GitHub
parent d7f9b098ed
commit 919aa29f15
3 changed files with 33 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tmpl/context_funcs_test.go
+19 -2
View File
@@ -38,14 +38,31 @@ func TestCreateFuncMap_DisabledInsecureFeatures(t *testing.T) {
funcMaps := ctx.createFuncMap()
args := make([]any, 0)
_, err1 := funcMaps["exec"].(func(command string, args []any, inputs ...string) (string, error))("ls", args)
require.ErrorIs(t, err1, DisableInsecureFeaturesErr)
require.ErrorIs(t, err1, DisableInsecureFunctionsErr)
_, err2 := funcMaps["readFile"].(func(filename string) (string, error))("context_funcs_test.go")
require.ErrorIs(t, err2, DisableInsecureFeaturesErr)
require.ErrorIs(t, err2, DisableInsecureFunctionsErr)
}
disableInsecureFeatures = currentVal
}
func TestCreateFuncMap_DisabledInsecureTemplateFunctions(t *testing.T) {
currentVal := disableInsecureTemplateFunctions
{
disableInsecureTemplateFunctions = true
ctx := &Context{basePath: "."}
funcMaps := ctx.createFuncMap()
args := make([]any, 0)
_, err1 := funcMaps["exec"].(func(command string, args []any, inputs ...string) (string, error))("ls", args)
require.ErrorIs(t, err1, DisableInsecureFunctionsErr)
_, err2 := funcMaps["readFile"].(func(filename string) (string, error))("context_funcs_test.go")
require.ErrorIs(t, err2, DisableInsecureFunctionsErr)
}
disableInsecureTemplateFunctions = currentVal
}
func newFSExpecting(expectedFilename string, expected string) *filesystem.FileSystem {
return filesystem.FromFileSystem(filesystem.FileSystem{
ReadFile: func(filename string) ([]byte, error) {