Simplify environment templating #45

New Issue

2020-05-15T18:40:07+02:00

veenj commented

2020-05-15 18:40:07 +02:00

(Migrated from gitlab.com)

At the moment using templates inside environment variables is verbose as every existing environment variable needs to be named before they can be used:

programs:
  - name: echo
    path: echo
    env:
      ENVVAR:
      ACTUAL_ENVVAR: "{{ ENVVAR }}-suffix"

An easier approach would allow users to reference any environment variable of cinit during templating, without passing the entire environment to the forked child:

programs:
  - name: echo
    path: echo
    env:
      ACTUAL_ENVVAR: "{{ ENVVAR }}-suffix"

Child echo is not given ENVVAR.

Compatibility

This is a breaking change as the second example will render to a different string than currently suggested by the documentation. To keep the change backward compatible a new CLI flag could be added to make the desired behaviour optional.

Security Considerations

This feature makes it easier to leak environment variable's data into a child which should not have access to it. A careless user might hand more data to the child than desirable. Thus care must be taken when referencing any variable from cinit's environment.

Implementation

Inside cinit::analyse::process_builder::copy_from_config maintain a separate dictionary context next to result. Initialise it with the environment from cinit and sanitise it with cinit::analyse::process_builder::sanitise_env. Then pass it as context to every templating operation and add the final text to the context as well.

At the moment using templates inside environment variables is verbose as every existing environment variable needs to be named before they can be used: ```yaml programs: - name: echo path: echo env: ENVVAR: ACTUAL_ENVVAR: "{{ ENVVAR }}-suffix" ``` An easier approach would allow users to reference any environment variable of cinit during templating, without passing the entire environment to the forked child: ```yaml programs: - name: echo path: echo env: ACTUAL_ENVVAR: "{{ ENVVAR }}-suffix" ``` Child `echo` is not given `ENVVAR`. ## Compatibility This is a breaking change as the second example will render to a different string than currently suggested by the documentation. To keep the change backward compatible a new CLI flag could be added to make the desired behaviour optional. ## Security Considerations This feature makes it easier to leak environment variable's data into a child which should not have access to it. A careless user might hand more data to the child than desirable. Thus care must be taken when referencing any variable from cinit's environment. ## Implementation Inside `cinit::analyse::process_builder::copy_from_config` maintain a separate dictionary `context` next to `result`. Initialise it with the environment from cinit and sanitise it with `cinit::analyse::process_builder::sanitise_env`. Then pass it as context to every templating operation and add the final text to the `context` as well.

Sign in to join this conversation.