blob: 1312309554b3469774a998b3be2c63801baf3a9c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
# Copyright 2021 Acme Gating, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
import re
VARNAME_RE = re.compile(r'^[A-Za-z0-9_]+$')
def check_varnames(var):
# We block these in configloader, but block it here too to make
# sure that a job doesn't pass variables named zuul or nodepool.
if 'zuul' in var:
raise Exception("Defining variables named 'zuul' is not allowed")
if 'nodepool' in var:
raise Exception("Defining variables named 'nodepool' is not allowed")
if 'unsafe_vars' in var:
raise Exception("Defining variables named 'unsafe_vars' "
"is not allowed")
for varname in var.keys():
if not VARNAME_RE.match(varname):
raise Exception("Variable names may only contain letters, "
"numbers, and underscores")
# Block some connection related variables so they cannot be
# overridden by jobs to bypass security mechanisms.
connection_vars = [
'ansible_connection',
'ansible_host',
'ansible_python_interpreter',
'ansible_shell_executable',
'ansible_user',
]
for conn_var in connection_vars:
if conn_var in var:
raise Exception(f"Variable name '{conn_var}' is not allowed.")
|
