Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rover doesn't sanitize inputs #204

Closed
shuft opened this issue Sep 17, 2021 · 2 comments · Fixed by #234
Closed

Rover doesn't sanitize inputs #204

shuft opened this issue Sep 17, 2021 · 2 comments · Fixed by #234
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed

Comments

@shuft
Copy link

shuft commented Sep 17, 2021

Rover doesn't properly sanitize arguments that it passes to Terraform, allowing you to pass on extra command line arguments such as -auto-approve if you'd like, is this a bug or a feature? :)

example:

rover -lz /tf/caf/landingzones/caf_launchpad
-var-folder /tf/caf/configuration/${environment}/level0/launchpad
-parallelism 30
-level level0
-env ${caf_environment}
-var prefix="im"
-launchpad
-a destroy -auto-approve

@LaurentLesle LaurentLesle added enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed labels Sep 20, 2021
@LaurentLesle
Copy link
Contributor

Thanks @shuft . Indeed this is not something the rover in bash is doing. We have an underlying work to re-write the rover in go lang and leverage a command line tool library that will help us achieving that goal with a much clearer code. However it is not expected anytime soon.
So from now it is a limitation of the rover bash. We welcome PR if this is something you are keen to address with the current bash version.

@LaurentLesle LaurentLesle linked a pull request Jan 18, 2022 that will close this issue
@LaurentLesle
Copy link
Contributor

I did add an initial support to sanitize the command. You can have a look and extend it if you find other use cases.

https://github.com/aztfmod/rover/blob/master/scripts/parse_command.sh

Keeping it opened from now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants