-
Notifications
You must be signed in to change notification settings - Fork 307
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Jsonnet parser cannot handle relative imports #939
Comments
It seems the current implementation uses the |
After some testing, it looks like the import path in the jsonnet config is relative to $PWD, not |
that is indeed behavior of conftest's jsonnet parser, but isn't that of the most jsonnet CLI implementation (such as google/go-jsonnet, google/jsonnet, etc). my request is to align conftest's import behavior to accept the exactly same jsonnet configuration as the known existing jsonnet implementation accepts. |
I would welcome a PR. |
Fix Jsonnet imports and add path restrictions to prevent unauthorized file access through import/importstr/importbin directives. Previously relative imports were not working and arbitrary files could be accessed. With this implementation imports beyond current working directory are blocked. Fixes open-policy-agent#939 Signed-off-by: Ville Vesilehto <[email protected]>
Fix Jsonnet imports and add path restrictions to prevent unauthorized file access through import/importstr/importbin directives. Previously relative imports were not working and arbitrary files could be accessed. With this implementation imports beyond current working directory are blocked. Fixes open-policy-agent#939 Signed-off-by: Ville Vesilehto <[email protected]>
Fix Jsonnet imports and add path restrictions to prevent path traversal through import/importstr/importbin directives. Previously relative imports were not working and arbitrary files could be accessed. With this implementation imports beyond current working directory are blocked. Fixes open-policy-agent#939 Signed-off-by: Ville Vesilehto <[email protected]>
I have a proposal in #1044 👍 |
Jsonnet has an
import
construct to load other jsonnet files. The following configuration successfully evaluates as follows:However, conftest cannot handle relative
import
s (in directories other than.
).Although the specification seems not specifying how the
import
-ed relative paths are resolved, most jsonnet implementations handle these paths as if they're relative to theimport
-ing file.We can work around this by
jsonnet config/main.jsonnet | conftest test -
, but native support is better in context ofdata.conftest.file
support, nicer error reportings, etc.Version information
The text was updated successfully, but these errors were encountered: