adoroszlai commented on a change in pull request #2934:
URL: https://github.com/apache/ozone/pull/2934#discussion_r772151824
##########
File path: hadoop-hdds/docs/config.yaml
##########
@@ -37,3 +37,21 @@ markup:
goldmark:
renderer:
unsafe: true
+security:
+ enableInlineShortcodes: false
+ exec:
+ allow:
+ - ^dart-sass-embedded$
+ - ^go$
+ - ^npx$
+ - ^postcss$
+ osEnv:
+ - (?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$
Review comment:
We can omit these defaults.
```suggestion
```
(You can verify that they are still part of the config by making a typo in
`OZONE_VERSION`, running `hugo` to reproduce the original issue, and checking
the "current security configuration" included in the error message.)
##########
File path: hadoop-hdds/docs/config.yaml
##########
@@ -37,3 +37,21 @@ markup:
goldmark:
renderer:
unsafe: true
+security:
+ enableInlineShortcodes: false
+ exec:
+ allow:
+ - ^dart-sass-embedded$
+ - ^go$
+ - ^npx$
+ - ^postcss$
+ osEnv:
+ - (?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$
+ funcs:
+ getenv:
+ - ^HUGO_|^OZONE_VERSION$
+ http:
+ methods:
+ - (?i)GET|POST
+ urls:
+ - .*
Review comment:
And these, too.
```suggestion
```
##########
File path: hadoop-hdds/docs/config.yaml
##########
@@ -37,3 +37,21 @@ markup:
goldmark:
renderer:
unsafe: true
+security:
+ enableInlineShortcodes: false
+ exec:
+ allow:
+ - ^dart-sass-embedded$
+ - ^go$
+ - ^npx$
+ - ^postcss$
+ osEnv:
+ - (?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$
+ funcs:
+ getenv:
+ - ^HUGO_|^OZONE_VERSION$
Review comment:
I would replace regex "or" with yaml list:
```suggestion
funcs:
getenv:
- ^HUGO_
- ^OZONE_VERSION$
```
I think it will be friendlier for `git diff` in case changes are needed in
the future.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
