When parsing json from untrusted sources, remove templating tags

This commit is contained in:
James Cammarata
2014-06-30 15:59:32 -05:00
parent eeb597360e
commit 8ed6350e65
5 changed files with 41 additions and 19 deletions

View File

@@ -497,7 +497,7 @@ class Runner(object):
cmd2 = conn.shell.remove(tmp, recurse=True)
self._low_level_exec_command(conn, cmd2, tmp, sudoable=False)
data = utils.parse_json(res['stdout'])
data = utils.parse_json(res['stdout'], from_remote=True)
if 'parsed' in data and data['parsed'] == False:
data['msg'] += res['stderr']
return ReturnData(conn=conn, result=data)

View File

@@ -43,8 +43,7 @@ class ReturnData(object):
self.diff = diff
if type(self.result) in [ str, unicode ]:
self.result = utils.parse_json(self.result)
self.result = utils.parse_json(self.result, from_remote=True)
if self.host is None:
raise Exception("host not set")