# New way to expose ones playbook to untrusted variables

**URL:** <https://forum.ansible.com/t/new-way-to-expose-ones-playbook-to-untrusted-variables/15926>\
**Category:** Ansible Project\
**Created:** [August 12, 2014, 8:10pm UTC](https://forum.ansible.com/t/new-way-to-expose-ones-playbook-to-untrusted-variables/15926 "2014-08-12T20:10:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tomasz\_Kontusz](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@Tomasz\_Kontusz](https://forum.ansible.com/u/Tomasz_Kontusz)\
**Post date:** [August 12, 2014, 8:10pm UTC](https://forum.ansible.com/t/new-way-to-expose-ones-playbook-to-untrusted-variables/15926/1 "2014-08-12T20:10:15Z")

</div>

Hi!  
I'm not sending this in as a security issue, as I don't think there are playbooks like that in the wild.

If I understood the changes in 1.6.7+ properly, they were about protecting against injecting arguments like this:

&nbsp;&nbsp;&nbsp;- set\_fact:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;foo: 'bar" mode="0666'  
&nbsp;&nbsp;&nbsp;- copy: content="{{ foo }}" dest=/etc/somesecret

But it seems it's still possible to create playbooks that are not safe against argument injection:

&nbsp;&nbsp;&nbsp;- set\_fact:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;foo: 'bar\n", "mode": "0666'  
&nbsp;&nbsp;&nbsp;- copy: ""  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;args: '{ "content": "{{ foo }}", "dest": "/tmp/foo" }'

Is it by accident, or is templating the whole args dictionary considered too funky to be used (and so, to secure)?

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 12, 2014, 8:42pm UTC](https://forum.ansible.com/t/new-way-to-expose-ones-playbook-to-untrusted-variables/15926/2 "2014-08-12T20:42:00Z")

</div>

Hi Tomasz,

All security fixes are intended to be resolved as of 1.7.10, not 1.6.7.

These issues were about injection of new parameters, not the fact that a particular value can be templated, especially one like content (which is useful and intentional).

If you think you have discovered something new, please contact us at [security@ansible.com](mailto:security@ansible.com) and we can agree on details and a release date.

Please see our security policy at [http://www.ansible.com/security](http://www.ansible.com/security) for information about reporting details.

Let’s discuss there ([security@ansible.com](mailto:security@ansible.com)) to avoid leaking a potential exploit, should you think you have one, which right now, I’m not seeing enough detail to see one.

Thank you!

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 12, 2014, 8:42pm UTC](https://forum.ansible.com/t/new-way-to-expose-ones-playbook-to-untrusted-variables/15926/3 "2014-08-12T20:42:18Z")

</div>

Slight correction, when I say 1.7.10 above, I mean 1.7.0.