diff options
Diffstat (limited to 'porting_guide_10.rst')
| -rw-r--r-- | porting_guide_10.rst | 25 |
1 files changed, 24 insertions, 1 deletions
diff --git a/porting_guide_10.rst b/porting_guide_10.rst index b485ddaae..536ff920a 100644 --- a/porting_guide_10.rst +++ b/porting_guide_10.rst @@ -18,7 +18,30 @@ We suggest you read this page along with the `Ansible 10 Changelog <https://gith Playbook ======== -No notable changes +* Conditionals - due to mitigation of security issue CVE-2023-5764 in ansible-core 2.16.1, + conditional expressions with embedded template blocks can fail with the message + "``Conditional is marked as unsafe, and cannot be evaluated.``" when an embedded template + consults data from untrusted sources like module results or vars marked ``!unsafe``. + Conditionals with embedded templates can be a source of malicious template injection when + referencing untrusted data, and can nearly always be rewritten without embedded + templates. Playbook task conditional keywords such as ``when`` and ``until`` have long + displayed warnings discouraging use of embedded templates in conditionals; this warning + has been expanded to non-task conditionals as well, such as the ``assert`` action. + + .. code-block:: yaml + + - name: task with a module result (always untrusted by Ansible) + shell: echo "hi mom" + register: untrusted_result + + # don't do it this way... + # - name: insecure conditional with embedded template consulting untrusted data + # assert: + # that: '"hi mom" is in {{ untrusted_result.stdout }}' + + - name: securely access untrusted values directly as Jinja variables instead + assert: + that: '"hi mom" is in untrusted_result.stdout' Command Line |