-
Notifications
You must be signed in to change notification settings - Fork 199
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ansible 7 (core 2.14) support, AnsibleUnsafeText fixes #1017
Conversation
Thanks a lot for looking into this @moreati! |
06ac0bc
to
48f6802
Compare
@moreati Any update on this? Is there something holding this back? |
And what about using 2.15? Or do I have to create a seperate issue for? |
LGTM! <3 |
@moreati Thanks for looking into this, we're using Ansible 2.14 and after this PR, is there any pending updates on it? |
Fixes #974 |
cefcb58
to
70b4802
Compare
a7c81e1
to
745cd4b
Compare
Co-authored-by: Orion Poplawski <orion@nwra.com>
If casting a string fails then raise a TypeError. This is potentially an API breaking change; chosen as the lesser evil vs. allowing silent errors. `cast()` relies on `bytes(obj)` & `str(obj)` returning the respective supertype. That's no longer the case for `AnsibleUnsafeBytes` & `AnsibleUnsafeText`; since fixes/mitigations for CVE-2023-5764. fixes mitogen-hq#1046, refs mitogen-hq#977 See also - GHSA-7j69-qfc3-2fq9 - ansible/ansible#82293
Prep work for ansible_mitogen.utils.unsafe
be1708e
to
7694334
Compare
Follwing fixes in Ansible 7-9 for CVE-2023-5764 cating `AnsibleUnsafeBytes` & `AnsibleUnsafeText` to `bytes()` or `str()` requires special handling. The handling is Ansible specific, so it shouldn't go in the mitogen package but rather the ansible_mitogen package. `ansible_mitogen.utils.unsafe.cast()` is most like `mitogen.utils.cast()`. During development it began as `ansible_mitogen.utils.unsafe.unwrap_var()`, closer to an inverse of `ansible.utils.unsafe_procy.wrap_var()`. Future enhancements may move in this direction. refs mitogen-hq#977, refs mitogen-hq#1046 See also - GHSA-7j69-qfc3-2fq9 - ansible/ansible#82293 - https://github.com/mitogen-hq/mitogen/wiki/AnsibleUnsafe-notes
I'm trying this out (first time trying out Mitogen actually) and I get an error fairly early in my playbook. My task is:
Looks like there's a problem while invoking the
|
Could you reduce this to a Minimal Reprodicing Example? It's difficult to say what is causing the failure in your pasted code - without knowing values of the variables involved. Could you also comfirm whether the latest release of Mitogen (0.3.5) exhibits the same error? You may need to try it with an earlier release of Ansible. |
Rather than allowing
AnsibleUnsafeText
to be pickled/unpickled this PR addsansible_mitogen.utils.unsafe.cast()
to cast them back to plain strings before sending to the target. This follows the implicit behaviour of plain Ansible, in which serialising to JSON then deserialising has the same effect.Thanks to @opoplawski for PR #977 on which this is based, and @AKrumov for investigation in #1034.