Giter Club home page Giter Club logo

Comments (5)

jvehent avatar jvehent commented on July 21, 2024

I think shell=True may be fine given that it's only invoked in editing mode, in a shell created by the user. If someone can inject malicious parameters in that user's environment, there are worse things to do than messing with $EDITOR.

from sops.

claudijd avatar claudijd commented on July 21, 2024

Decent read here in stackoverflow that helped me catch up on the issue:
http://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess

@jbuck I would modify $EDITOR first to use a fully-qualified path first and and make sure you're running the latest version of bbedit.

@jvehent if @jbuck continues to have issues after those two are complete, you can probably modify the sops bin to extract and expand the path for the $EDITOR value and hopefuly avoid this bug. If it's some weird internal thing in bbedit, maybe it can be reported upstream to see if they'd be willing to make a change. I'd try all those options before shell=True, since it's likely people will wrap some automation code around this tool and do poor input validation that gives rise to command injections vulns.

Another option you could try is make it configurable in sops with a warning about the implications and leave the default as shell=False.

from sops.

jbuck avatar jbuck commented on July 21, 2024

I tried with vim instead of bbedit to rule out something strange that it's doing:

(assume-aws-role prod)$ EDITOR='vim' sops common.yaml
INFO: assuming AWS role 'arn:aws:sts::361527076523:assumed-role/hiera-sops-prod/sops@jbuckley-23775'
INFO: temp file created at /var/folders/q2/vhg0j08n3fz3zsvph1rsw5080000gn/T/tmpRDS4a1.yaml
PANIC: common.yaml has not been modified, exit without writing
(assume-aws-role prod)$ EDITOR='vim -C' sops common.yaml
INFO: assuming AWS role 'arn:aws:sts::361527076523:assumed-role/hiera-sops-prod/sops@jbuckley-23775'
INFO: temp file created at /var/folders/q2/vhg0j08n3fz3zsvph1rsw5080000gn/T/tmp_tnTJ0.yaml
OSError: [Errno 2] No such file or directory
(assume-aws-role prod)$ EDITOR='vim ' sops common.yaml
INFO: assuming AWS role 'arn:aws:sts::361527076523:assumed-role/hiera-sops-prod/sops@jbuckley-23775'
INFO: temp file created at /var/folders/q2/vhg0j08n3fz3zsvph1rsw5080000gn/T/tmpdQLbuN.yaml
OSError: [Errno 2] No such file or directory

I had a look at the manpage for BBEdit and they explictly call out that some tools may not work correctly:

--resume (no short variant) Used in combination with -w or --wait, this switch
will cause the application which was frontmost when the bbedit tool was invoked
to be made frontmost again once you close the file(s) specified on the command
line.

  This is convenient if you are using the Terminal (or any third-party
  equivalent) to invoke a command which uses BBEdit as its editor (p4, cvs), and
  want to return back to the Terminal when the editing session is over.

    bbedit --wait --resume  ~/foo.txt

-w, --wait Wait until the file is closed in BBEdit. Normally, the bbedit tool
exits immediately after the file arguments are opened in BBEdit. This option
applies to both local files and files opened from FTP or SFTP servers.

  The -w option allows the bbedit tool to be used as an external editor for Unix
  tools that use the EDITOR global environment variable. To make this work using
  tcsh, add the following line to your .cshrc (or .tcshrc) file:

    setenv EDITOR "bbedit -w"

  Some tools (notably crontab), will not work correctly if your EDITOR variable
  consists of multiple terms. You can work around this by creating a simple
  shell script that calls bbedit -w, then using the shell script as your EDITOR.
  For example:

    #!/bin/sh
    bbedit -w "$@"

from sops.

gdestuynder avatar gdestuynder commented on July 21, 2024

without shell=True the env variables ($EDITOR) aren't automagically expanded and the path aren't automatogically expanded either ($PATH) - both are things that a shell will do for you.

Alternative is doing it by hand (os.path.expandvar and going through manually.. pain but might be what you want there - though parameters like bbedit -blah will still not work unless you also check for arguments in $EDITOR), or using shell=True (which starts a shell really - sure its a little more dangerous and not very portable, though in some cases its totally ok, when you expect to use shell stuff, you gotta use a shell for example).

IIRC that's about it..

from sops.

jvehent avatar jvehent commented on July 21, 2024

Thank you gents. Let's see how far my patch takes us, and if people need more we can revisit.

from sops.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.