fix(controller): Remove un-safe Sprig funcs. Fixes #5286 (#5850)

Signed-off-by: Alex Collins <alex_collins@intuit.com>
argoproj · May 7, 2021 · 1a53935 · 1a53935
1 parent 206aff0
commit 1a53935
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/util/expr/env/env.go b/util/expr/env/env.go
@@ -13,6 +13,8 @@ func GetFuncMap(m map[string]interface{}) map[string]interface{} {
 	for k, v := range exprpkg.GetExprEnvFunctionMap() {
 		env[k] = v
 	}
+	delete(env, "env")
+	delete(env, "expandenv")
 	env["toJson"] = toJson
 	env["sprig"] = sprig.GenericFuncMap()
 	return env