-
Notifications
You must be signed in to change notification settings - Fork 0
Review Sprig os* functions in safe template allowlist #10
Copy link
Copy link
Open
Labels
area/templatingTemplate parsing, validation, or evaluation changes.Template parsing, validation, or evaluation changes.good first issueSmall, well-scoped tasks for new contributors.Small, well-scoped tasks for new contributors.help wantedLooking for community contributions.Looking for community contributions.kind/featureNew functionality or enhancement request.New functionality or enhancement request.priority/lowNice-to-have or backlog item.Nice-to-have or backlog item.
Metadata
Metadata
Assignees
Labels
area/templatingTemplate parsing, validation, or evaluation changes.Template parsing, validation, or evaluation changes.good first issueSmall, well-scoped tasks for new contributors.Small, well-scoped tasks for new contributors.help wantedLooking for community contributions.Looking for community contributions.kind/featureNew functionality or enhancement request.New functionality or enhancement request.priority/lowNice-to-have or backlog item.Nice-to-have or backlog item.
Problem statement
The safe Sprig function allowlist in
templating/funcs.goincludes filesystem path helpers:osBase,osClean,osDir,osExt,osIsAbs. These functions operate on string arguments (not the filesystem), but they could leak host path structure information if a template author passes server-side values through them.Additionally, there is no test that fails when Sprig adds new functions in future versions, meaning new potentially dangerous functions could silently become available.
Proposed change
Evaluate whether
osBase,osClean,osDir,osExt,osIsAbsbelong in the safe list. They operate on strings only (no filesystem access), but they reveal OS-specific path semantics. Decide and document the reasoning either way.Add a comprehensive Sprig function audit test that fails if unreviewed functions appear:
This ensures any Sprig version bump forces an explicit review of new functions.
Affected area
templatingCompatibility / migration
If any os* functions are removed from the safe list, templates using them would fail validation. This would be a minor breaking change requiring a changelog note.
Alternatives considered
Additional context
The existing denylist test in
funcs_test.gochecksenv,expandenv,repeat,seq,until,untilStep,getHostByName. This issue proposes making that test exhaustive. Identified during security review.