search

aztfmod / rover

The rover is a docker container in charge of the deployment of the Terraform platform engineering for Azure
MIT License
176 stars 146 forks source link

Rover doesn't sanitize inputs #204

Closed shuft closed 2 years ago

shuft commented 3 years ago

Rover doesn't properly sanitize arguments that it passes to Terraform, allowing you to pass on extra command line arguments such as -auto-approve if you'd like, is this a bug or a feature? :)

example:

rover -lz /tf/caf/landingzones/caf_launchpad \ -var-folder /tf/caf/configuration/${environment}/level0/launchpad \ -parallelism 30 \ -level level0 \ -env ${caf_environment} \ -var prefix="im" \ -launchpad \ -a destroy -auto-approve

LaurentLesle commented 3 years ago

Thanks @shuft . Indeed this is not something the rover in bash is doing. We have an underlying work to re-write the rover in go lang and leverage a command line tool library that will help us achieving that goal with a much clearer code. However it is not expected anytime soon. So from now it is a limitation of the rover bash. We welcome PR if this is something you are keen to address with the current bash version.

LaurentLesle commented 2 years ago

I did add an initial support to sanitize the command. You can have a look and extend it if you find other use cases.

https://github.com/aztfmod/rover/blob/master/scripts/parse_command.sh

Keeping it opened from now.