diff options
| author | Michal Nasiadka <mnasiadka@gmail.com> | 2026-06-10 17:27:50 +0100 |
|---|---|---|
| committer | Michal Nasiadka <mnasiadka@gmail.com> | 2026-06-10 23:45:30 +0000 |
| commit | 0b20ffce09552014fa52c45de574511dc2200ac5 (patch) | |
| tree | 725cde92aacabe30bf61c15fdc7c10b42b05c8e0 /kolla/image | |
| parent | d55c024327531bf255d96021dfbc8e84a364f9c0 (diff) | |
| download | kolla-0b20ffce09552014fa52c45de574511dc2200ac5.tar.gz kolla-0b20ffce09552014fa52c45de574511dc2200ac5.zip | |
kolla-build: Use SandboxedEnvironment to prevent SSTI
Switch from jinja2.Environment to
jinja2.sandbox.SandboxedEnvironment to block Server-Side Template
Injection attacks.
Closes-Bug: #2146056
Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
Diffstat (limited to 'kolla/image')
| -rw-r--r-- | kolla/image/kolla_worker.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/kolla/image/kolla_worker.py b/kolla/image/kolla_worker.py index 680595f86..b60f0558f 100644 --- a/kolla/image/kolla_worker.py +++ b/kolla/image/kolla_worker.py @@ -23,6 +23,7 @@ import tempfile import time import jinja2 +import jinja2.sandbox from kolla.common import config as common_config from kolla.common import utils from kolla.engine_adapter import engine @@ -392,7 +393,7 @@ class KollaWorker(object): 'build_date': build_date, 'clean_package_cache': self.clean_package_cache, 'patches_path': self.patches_path} - env = jinja2.Environment( # nosec: not used to render HTML + env = jinja2.sandbox.SandboxedEnvironment( loader=jinja2.FileSystemLoader(self.working_dir)) env.filters.update(self._get_filters()) env.globals.update(self._get_methods()) @@ -405,7 +406,7 @@ class KollaWorker(object): tpl_dict = self._merge_overrides(self.conf.template_override) template_name = os.path.basename(list(tpl_dict.keys())[0]) values['parent_template'] = template - env = jinja2.Environment( # nosec: not used to render HTML + env = jinja2.sandbox.SandboxedEnvironment( loader=jinja2.DictLoader(tpl_dict)) env.filters.update(self._get_filters()) env.globals.update(self._get_methods()) |