saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-16 09:40:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

pass: Do not modify $HOME env globally

Browse source 
Just set $HOME for calling the pass binary
to avoid affecting anything outside the pass renderer.
This commit is contained in:
Daniel Mach 2022-05-27 11:25:18 +02:00 • committed by Megan Wilhite
parent 8270d639c7
commit 4813a9f533
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog/62120.fixed
View file

@ -1,2 +1,3 @@
The $HOME env is no longer modified globally.
Only trailing newlines are stripped from the fetched secret.
Pass process arguments are handled in a secure way.

11
salt/renderers/pass.py
View file

@ -84,7 +84,12 @@ def _fetch_secret(pass_path):
cmd = ["pass", "show", pass_path]
log.debug("Fetching secret: %s", " ".join(cmd))
proc = Popen(cmd, stdout=PIPE, stderr=PIPE)
# Make sure environment variable HOME is set, since Pass looks for the
# password-store under ~/.password-store.
env = os.environ.copy()
env["HOME"] = expanduser("~")
proc = Popen(cmd, stdout=PIPE, stderr=PIPE, env=env)
pass_data, pass_error = proc.communicate()
# The version of pass used during development sent output to
@ -115,8 +120,4 @@ def render(pass_info, saltenv="base", sls="", argline="", **kwargs):
Fetch secret from pass based on pass_path
"""
_get_pass_exec()
# Make sure environment variable HOME is set, since Pass looks for the
# password-store under ~/.password-store.
os.environ["HOME"] = expanduser("~")
return _decrypt_object(pass_info)