Repository navigation
fix: sandbox Jinja2 rendering in standard template create path - #472
Open
mufaddal-rohawala wants to merge 1 commit into
Open
mufaddal-rohawala wants to merge 1 commit into
mufaddal-rohawala wants to merge 1 commit into
Conversation
`hyp create` rendered standard project template manifests (k8s.jinja /
cfn_params.jinja) with an unsandboxed `jinja2.Template`. Template
expressions could traverse Python internals (e.g.
`{{ cycler.__init__.__globals__ }}`) to reach os/subprocess, allowing
arbitrary code execution when a user runs `hyp create` on a malicious
project scaffold.
The recipe rendering path (recipe_utils._render_k8s_template) was already
sandboxed with SandboxedEnvironment, but the standard-template path in
_create_standard_template was still using the unsandboxed Template. This
change switches it to ImmutableSandboxedEnvironment so unsafe attribute and
callable access is blocked.
Adds regression tests that assert an SSTI payload does not execute, that
rendering such a payload fails safely, and that benign templates still
render.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
hyp createrenders standard project template manifests (k8s.jinja/cfn_params.jinja) using an unsandboxedjinja2.Template. Jinja2 expressions in those files can traverse Python internals (e.g.{{ cycler.__init__.__globals__ }}) to reachos/subprocess, which means rendering a template authored in a project scaffold can execute arbitrary code on the user's machine when they runhyp create.The recipe rendering path (
recipe_utils._render_k8s_template) is already hardened withSandboxedEnvironment, but the standard-template path in_create_standard_templatewas still using the unsandboxedTemplate. This PR brings the two paths in line.Change
src/sagemaker/hyperpod/cli/commands/init.py: render withjinja2.sandbox.ImmutableSandboxedEnvironmentinstead ofjinja2.Template, so unsafe attribute/callable access is blocked.test/unit_tests/cli/test_init.py: regression tests asserting that an internals-traversing payload does not execute, that rendering it fails safely, and that benign templates still render.Testing