zuul/zuul/ansible/lookup/filetree.py
Monty Taylor d08b4ce374
Start blocking lookup plugins on insecure jobs
Some of the lookup plugins access files on the executor host. Obviously
that's not what we want, so block them like we block action plugins.

password.py is banned, although it could be filtered. However, the
upstream code is fairly intense and slated for refactoring - so let's
wait until someone gets upset about it.

Change-Id: I6260b4658619a972b588c8bfba40ec33557bf2f6
2017-04-06 13:43:50 -05:00

33 lines
1.2 KiB
Python

# Copyright 2017 Red Hat, Inc.
#
# This module is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This software is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this software. If not, see <http://www.gnu.org/licenses/>.
import os
from zuul.ansible import paths
filetree = paths._import_ansible_lookup_plugin("filetree")
class LookupModule(filetree.LookupModule):
def run(self, terms, variables=None, **kwargs):
basedir = self.get_basedir(variables)
for term in terms:
term_file = os.path.basename(term)
dwimmed_path = self._loader.path_dwim_relative(
basedir, 'files', os.path.dirname(term))
path = os.path.join(dwimmed_path, term_file)
paths._fail_if_unsafe(path)
return super(LookupModule, self).run(terms, variables, **kwargs)