From d4aa8ee09e2d6e6676ed2dd7144d541e359fef7e Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Wed, 10 Jun 2026 17:27:50 +0100 Subject: kolla-build: Use SandboxedEnvironment to prevent SSTI Switch from jinja2.Environment to jinja2.sandbox.SandboxedEnvironment to block Server-Side Template Injection attacks. Closes-Bug: #2146056 Change-Id: Iecd1d8dcf99007e3339120961c7c1d0ca12f83d8 Signed-off-by: Michal Nasiadka (cherry picked from commit 0b20ffce09552014fa52c45de574511dc2200ac5) --- kolla/tests/test_validate_all_file.py | 43 +++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 kolla/tests/test_validate_all_file.py (limited to 'kolla/tests/test_validate_all_file.py') diff --git a/kolla/tests/test_validate_all_file.py b/kolla/tests/test_validate_all_file.py new file mode 100644 index 000000000..04dab530e --- /dev/null +++ b/kolla/tests/test_validate_all_file.py @@ -0,0 +1,43 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import importlib.util +import os +import tempfile +from unittest import mock + +from kolla.tests import base + +_VALIDATE_SCRIPT = os.path.abspath( + os.path.join(os.path.dirname(__file__), '..', '..', 'tools', + 'validate-all-file.py')) +_spec = importlib.util.spec_from_file_location('validate_all_file', + _VALIDATE_SCRIPT) +validate_all_file = importlib.util.module_from_spec(_spec) +_spec.loader.exec_module(validate_all_file) + +_SSTI_PAYLOAD = ( + "{{ self.__init__.__globals__['__builtins__']" + "['__import__']('os').popen('id').read() }}" +) + + +class ValidateAllFileTest(base.TestCase): + + def test_check_json_j2_ssti_blocked(self): + with tempfile.TemporaryDirectory() as tmpdir: + malicious = os.path.join(tmpdir, 'test.json.j2') + with open(malicious, 'w') as f: + f.write(_SSTI_PAYLOAD + '\n') + with mock.patch.object(validate_all_file, 'PROJECT_ROOT', tmpdir): + result = validate_all_file.check_json_j2() + self.assertEqual(1, result) -- cgit v1.2.3