CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-20 16:03:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Future proof the jinja check to ensure the script does not silently overwrite jinja templates

Browse Source
This commit is contained in:
Jason Ertel
2022-07-08 17:30:00 -04:00
parent a8e6b26406
commit 4f8bb6049b
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
salt/common/tools/sbin/so-firewall
View File

@@ -27,6 +27,7 @@ hostgroupsFilename = "/opt/so/saltstack/local/salt/firewall/hostgroups.local.yam
portgroupsFilename = "/opt/so/saltstack/local/salt/firewall/portgroups.local.yaml" portgroupsFilename = "/opt/so/saltstack/local/salt/firewall/portgroups.local.yaml"
defaultPortgroupsFilename = "/opt/so/saltstack/default/salt/firewall/portgroups.yaml" defaultPortgroupsFilename = "/opt/so/saltstack/default/salt/firewall/portgroups.yaml"
supportedProtocols = ['tcp', 'udp'] supportedProtocols = ['tcp', 'udp']
readonly = False
def showUsage(options, args): def showUsage(options, args):
print('Usage: {} [OPTIONS] <COMMAND> [ARGS...]'.format(sys.argv[0])) print('Usage: {} [OPTIONS] <COMMAND> [ARGS...]'.format(sys.argv[0]))
@@ -71,17 +72,26 @@ def checkApplyOption(options):
return apply(None, None) return apply(None, None)
def loadYaml(filename): def loadYaml(filename):
global readonly
file = open(filename, "r") file = open(filename, "r")
content = file.read() content = file.read()
# Remove Jinja templating # Remove Jinja templating (for read-only operations)
content = content.replace("{{ ssh_port }}", "22") if "{%" in content or "{{" in content:
pattern = r'.*({%|{{|}}|%}).*' content = content.replace("{{ ssh_port }}", "22")
content = re.sub(pattern, "", content) pattern = r'.*({%|{{|}}|%}).*'
content = re.sub(pattern, "", content)
readonly = True
return yaml.safe_load(content) return yaml.safe_load(content)
def writeYaml(filename, content): def writeYaml(filename, content):
global readonly
if readonly:
raise Exception("Cannot write yaml file that has been flagged as read-only")
file = open(filename, "w") file = open(filename, "w")
return yaml.dump(content, file) return yaml.dump(content, file)