[PR] security(dbt): Fix potential SSTI-to-RCE vector in dbt converter jinja [ossie]

["QMalcolm (via GitHub)" <gi...@apache.org>]

QMalcolm opened a new pull request, #398:
URL: https://github.com/apache/ossie/pull/398

   rendering
   
   The `_render_filter_template` function in `filter_utils.py` was rendering jinja in a non-sandboxed environment. This meant that if the converter wasrun on a project containing untrusted input, a potential SSTI-to-RCE vector was available. By sandboxing the environment, we eliminate the issue.
   
   <!--
     Licensed to the Apache Software Foundation (ASF) under one
     or more contributor license agreements.  See the NOTICE file
     distributed with this work for additional information
     regarding copyright ownership.  The ASF licenses this file
     to you under the Apache License, Version 2.0 (the
     "License"); you may not use this file except in compliance
     with the License.  You may obtain a copy of the License at
   
       http://www.apache.org/licenses/LICENSE-2.0
   
     Unless required by applicable law or agreed to in writing,
     software distributed under the License is distributed on an
     "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
     KIND, either express or implied.  See the License for the
     specific language governing permissions and limitations
     under the License.
   -->
   
   ## Summary
   
   Fixes a security issue in the jinja rendering of the dbt MSI -> Ossie converter.
   
   ## Related Issues
   
   <!-- Link any related GitHub issues: Closes #123, Fixes #456 -->
   
   ## Checklist
   
   ### Specification
   - [ ] Spec changes are included in `core-spec/` and follow the existing structure
   - [ ] Spec changes have been discussed on the mailing list or in a linked issue
   - [ ] Breaking changes to the spec are clearly called out in the summary
   
   ### Ontology
   - [ ] Ontology changes in `ontology/` are consistent with spec changes
   - [ ] New or modified terms are defined and documented
   
   ### Converters
   - [ ] Converter logic in `converters/` is updated to reflect spec or ontology changes
   - [ ] New converters include tests under the converter's test directory
   
   ### Validation
   - [ ] Validation rules in `validation/` are updated if the spec changed
   - [ ] New validation cases are covered by tests
   
   ### Documentation
   - [ ] `docs/` is updated to reflect any user-facing changes
   - [ ] New features or behaviors are documented with examples where appropriate
   - [ ] `CONTRIBUTING.md` is updated if the contribution process changed
   
   ### Examples
   - [ ] `examples/` are added or updated for any new spec constructs or converter support
   
   ### Tests
   - [ ] All existing tests pass (`pytest` / CI green)
   - [ ] New functionality is covered by tests
   
   ### Compliance
   - [ ] ASF license headers are present on all new source files
   - [ ] No third-party dependencies are added without PMC/IPMC approval


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] security(dbt): Fix potential SSTI-to-RCE vector in dbt converter jinja [ossie]

["QMalcolm (via GitHub)" <gi...@apache.org>]

QMalcolm merged PR #398:
URL: https://github.com/apache/ossie/pull/398


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ossie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org