From 8aa850e3573e48c9a2f12aef84e8a3a6f5ba4847 Mon Sep 17 00:00:00 2001 From: Brian Coca Date: Fri, 11 Jun 2021 17:43:22 -0400 Subject: [PATCH] fix unsafe preservation across newlines (#74960) (#74975) CVE-2021-3583 ensure we always have unsafe Co-authored-by: Rick Elrod (cherry picked from commit 4c8c40fd3d4a58defdc80e7d22aa8d26b731353e) --- changelogs/fragments/fix_unsafe_newline.yml | 2 ++ lib/ansible/template/__init__.py | 5 ++++- test/integration/targets/template/runme.sh | 4 ++++ test/integration/targets/template/unsafe.yml | 19 +++++++++++++++++++ 4 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 changelogs/fragments/fix_unsafe_newline.yml create mode 100644 test/integration/targets/template/unsafe.yml diff --git a/changelogs/fragments/fix_unsafe_newline.yml b/changelogs/fragments/fix_unsafe_newline.yml new file mode 100644 index 00000000000..44180c6237f --- /dev/null +++ b/changelogs/fragments/fix_unsafe_newline.yml @@ -0,0 +1,2 @@ +security_fixes: + - templating engine fix for not preserving usnafe status when trying to preserve newlines. CVE-2021-3583 diff --git a/lib/ansible/template/__init__.py b/lib/ansible/template/__init__.py index b9cd5973386..fe5cbf666b5 100644 --- a/lib/ansible/template/__init__.py +++ b/lib/ansible/template/__init__.py @@ -1064,7 +1064,8 @@ class Templar: try: res = j2_concat(rf) - if getattr(new_context, 'unsafe', False): + unsafe = getattr(new_context, 'unsafe', False) + if unsafe: res = wrap_var(res) except TypeError as te: if 'AnsibleUndefined' in to_native(te): @@ -1094,6 +1095,8 @@ class Templar: res_newlines = _count_newlines_from_end(res) if data_newlines > res_newlines: res += self.environment.newline_sequence * (data_newlines - res_newlines) + if unsafe: + res = wrap_var(res) return res except (UndefinedError, AnsibleUndefinedVariable) as e: if fail_on_undefined: diff --git a/test/integration/targets/template/runme.sh b/test/integration/targets/template/runme.sh index cb00df754d7..1b4e980e5bb 100755 --- a/test/integration/targets/template/runme.sh +++ b/test/integration/targets/template/runme.sh @@ -34,3 +34,7 @@ ansible-playbook 6653.yml -v "$@" # https://github.com/ansible/ansible/issues/72262 ansible-playbook 72262.yml -v "$@" + +# ensure unsafe is preserved, even with extra newlines +ansible-playbook unsafe.yml -v "$@" + diff --git a/test/integration/targets/template/unsafe.yml b/test/integration/targets/template/unsafe.yml new file mode 100644 index 00000000000..6746e1ea0ca --- /dev/null +++ b/test/integration/targets/template/unsafe.yml @@ -0,0 +1,19 @@ +- hosts: localhost + gather_facts: false + vars: + nottemplated: this should not be seen + imunsafe: !unsafe '{{ nottemplated }}' + tasks: + + - set_fact: + this_was_unsafe: > + {{ imunsafe }} + + - set_fact: + this_always_safe: '{{ imunsafe }}' + + - name: ensure nothing was templated + assert: + that: + - this_always_safe == imunsafe + - imunsafe == this_was_unsafe.strip()