suyiiyii/yq
1
0
Fork 0
mirror of https://github.com/mikefarah/yq.git synced 2026-09-01 14:14:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Address deep review feedback: error on disabled, strict arg/cmd validation, debug logs, docs

Browse Source 
Agent-Logs-Url: https://github.com/mikefarah/yq/sessions/fbfba2db-60ea-4c20-a4c2-0fd396b80c81

Co-authored-by: mikefarah <1151925+mikefarah@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-04-08 06:44:30 +00:00
committed by GitHub
co-authored by mikefarah
parent 6f94991c2a
commit 62d28d5495
4 changed files with 45 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/yqlib/doc/operators/headers/system-operators.md
+6 -2
View File
@@ -4,6 +4,10 @@ The `system` operator allows you to run an external command and use its output a
**Security warning**: The system operator is disabled by default. You must explicitly pass `--security-enable-system-operator` to use it.
**Note:** When enabled, the system operator can replicate the functionality of `env` and `load`
operators via external commands. Enabling it effectively overrides `--security-disable-env-ops`
and `--security-disable-file-ops`.
## Usage
```bash
@@ -12,12 +16,12 @@ yq --security-enable-system-operator --null-input '.field = system("command"; "a
The operator takes:
- A command string (required)
- An argument or array of arguments separated by `;` (optional)
- An argument (or an array of arguments), separated from the command by `;` (optional)
The current matched node's value is serialised and piped to the command via stdin. The command's stdout (with trailing newline stripped) is returned as a string.
## Disabling the system operator
The system operator is disabled by default. When disabled, a warning is logged and `null` is returned instead of running the command.
The system operator is disabled by default. When disabled, an error is returned instead of running the command, consistent with `--security-disable-env-ops` and `--security-disable-file-ops`.
Use `--security-enable-system-operator` flag to enable it.
pkg/yqlib/doc/operators/system-operators.md
+9 -5
View File
@@ -4,6 +4,10 @@ The `system` operator allows you to run an external command and use its output a
**Security warning**: The system operator is disabled by default. You must explicitly pass `--security-enable-system-operator` to use it.
**Note:** When enabled, the system operator can replicate the functionality of `env` and `load`
operators via external commands. Enabling it effectively overrides `--security-disable-env-ops`
and `--security-disable-file-ops`.
## Usage
```bash
@@ -12,17 +16,17 @@ yq --security-enable-system-operator --null-input '.field = system("command"; "a
The operator takes:
- A command string (required)
- An argument or array of arguments separated by `;` (optional)
- An argument (or an array of arguments), separated from the command by `;` (optional)
The current matched node's value is serialised and piped to the command via stdin. The command's stdout (with trailing newline stripped) is returned as a string.
## Disabling the system operator
The system operator is disabled by default. When disabled, a warning is logged and `null` is returned instead of running the command.
The system operator is disabled by default. When disabled, an error is returned instead of running the command, consistent with `--security-disable-env-ops` and `--security-disable-file-ops`.
Use `--security-enable-system-operator` flag to enable it.
## system operator returns null when disabled
## system operator returns error when disabled
Use `--security-enable-system-operator` to enable the system operator.
Given a sample.yml file of:
@@ -34,8 +38,8 @@ then
yq '.country = system("/usr/bin/echo"; "test")' sample.yml
```
will output
```yaml
country: null
```bash
Error: system operations are disabled, use --security-enable-system-operator to enable
```
## Run a command with an argument