Re: [ansible-project] security implications of: local_action: shell command {{ fact_var }}

No, Ansible can only protect you so much, like in normal shell, you really want to quote variable input: `cat "{{fact123}}"` would work the same as when running a shell script `cat "$MYVAR"` -- Brian Coca -- You received this message because you are subscribed to the Google Groups

[ansible-project] security implications of: local_action: shell command {{ fact_var }}

Hi, similar to a previous question [1] that was answered by Brian I'm wondering if the following example gives the remote server remote command execution privileges on the ansible host (which obviously no one wants): local_action: shell cat {{ fact123 }} Is that a bad idea? Can the remote

Re: [ansible-project] security implications of: local_action: shell command {{ fact_var }}

thanks for your fast reply! Brian Coca: > No, Ansible can only protect you so much, like in normal shell, you > really want to quote variable input: > > `cat "{{fact123}}"` would work the same as when running a shell script > `cat "$MYVAR"` So you confirm that my example gives the remote