Jira (PUP-2808) generate is too safe (false sense security)

[Rodney Beede (JIRA)]

Title: Message Title

Rodney Beede created an issue   Puppet / PUP-2808 generate is too safe (false sense security) Issue Type: Improvement Assignee: Unassigned Created: 19/Jun/14 10:19 AM Priority: Minor Reporter: Rodney Beede Original Estimate: 1 minute Remaining Estimate: 1 minute Taken from https://projects.puppetlabs.com/issues/5481 (Export to JIRA button didn't work). "The generate[1] function is too safe. We should encourage people to do safe things and perhaps log warnings when they do not, but we should not keep people from running commands that we deem to be unsafe." An example is given that shows it is possible to bypass the intended restriction/protection of this command. BEGIN QUOTE First let me point out a workaround: generate(“/bin/sh”, “-c”, “/usr/bin/uptime | /usr/bin/awk ‘ {print $3} ’ | cut -d, -f1”) Second, let me say that this workaround demonstrates that the safety built into this command is completely and totally worthless right now. However I suspect that the original attempt at safety was misguided anyway. What’s the issue that we’re protecting from? Hackers inserting malicious commands into your puppet configuration? If hackers can do that, the horse has already left the barn. In other words these safety checks are broken on both ends – they are not needed, and even if they were they don’t work. END QUOTE So the following comment seems relevant: "The question I have now is how different the code paths are between an Exec and a generate() call. Shouldn’t we be sharing most of this code?" This should be evaluated as to decide whether the code should be refactored or modified. Add Comment   This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.