suyiiyii/yq
1
0
Fork 0
mirror of https://github.com/mikefarah/yq.git synced 2026-09-01 14:14:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added flags to disable env and file ops #2515

Browse Source
This commit is contained in:
Mike Farah
2025-11-22 09:40:03 +11:00
parent c716d157f2
commit f00852bc6c
10 changed files with 222 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/yqlib/operator_env_test.go
+37
View File
@@ -250,3 +250,40 @@ func TestEnvOperatorScenarios(t *testing.T) {
}
documentOperatorScenarios(t, "env-variable-operators", envOperatorScenarios)
}
var envOperatorSecurityDisabledScenarios = []expressionScenario{
{
description: "env() operation fails when security is enabled",
subdescription: "Use `--security-disable-env-ops` to disable env operations for security.",
expression: `env("MYENV")`,
expectedError: "env operations have been disabled",
},
{
description: "strenv() operation fails when security is enabled",
subdescription: "Use `--security-disable-env-ops` to disable env operations for security.",
expression: `strenv("MYENV")`,
expectedError: "env operations have been disabled",
},
{
description: "envsubst() operation fails when security is enabled",
subdescription: "Use `--security-disable-env-ops` to disable env operations for security.",
expression: `"value: ${MYENV}" | envsubst`,
expectedError: "env operations have been disabled",
},
}
func TestEnvOperatorSecurityDisabledScenarios(t *testing.T) {
// Save original security preferences
originalDisableEnvOps := ConfiguredSecurityPreferences.DisableEnvOps
defer func() {
ConfiguredSecurityPreferences.DisableEnvOps = originalDisableEnvOps
}()
// Test that env() fails when DisableEnvOps is true
ConfiguredSecurityPreferences.DisableEnvOps = true
for _, tt := range envOperatorSecurityDisabledScenarios {
testScenario(t, &tt)
}
appendOperatorDocumentScenario(t, "env-variable-operators", envOperatorSecurityDisabledScenarios)
}