| Re: [che-dev] adding environment variables support to Builder.class |
|
Hi, The only issue that I see in the example that you provided is as following : In order for the system that runs che to become vulnerable, that system must run a builder implementation that reads that user sent variable "ZZZ" and execute
its value in a shell. The issue with this is that an application executing user input without validation is a bad security practice on its own , regardless of what I'm trying to achieve
. I'm not going to provide such a builder implementation and I think we shouldn’t merge such a builder implementation in to che. Regarding your question "
How builder implementation can prevent such security vulnerability?"
I have 2 solutions for that problem : 1.
Never execute user input directly as is in the builder. 2.
And if you must (for some reason), use a "white list. Anyhow, in my case the builder I'm implementing will read the input, from the request, based on the input will execute some logic and save the result in the env
variables for the command to use. . The builder itself will not use the input as is directly . Hence I don’t see the issue . One additional point to mention is that if someone wants to implement a builder that harm the system it running on , he doesn’t need my pull request to do it. He can just execute in the builder any of the request options ( "options": "Map[string,string]" ) passed in by the request from the user . Eventually it comes down to the builder implementation to enforce the security . BR Dany. From: che-dev-bounces@xxxxxxxxxxx [mailto:che-dev-bounces@xxxxxxxxxxx]
On Behalf Of Alexander Garagatyi We can consider such functionality for builder, but I'm concerned about security of that solution. Example: Build tool for project is set in such way that it's read env variables and send it over network. Than user sends build request with such env variable ZZZ=$(find ~/.ssh/ -type f | xargs cat) How builder implementation can prevent such security vulnerability? Implementations like docker won't be vulnerable for that, but what about not isolated environments? On Thu, Jun 18, 2015 at 10:32 AM, Shapiro, Dany <dany.shapiro@xxxxxxx> wrote:
-- |
