Nur bestimmte Variablennamen zulassen, so gewinnen wir einen privaten Adressraum
@@ -4,6 +4,7 @@ import (
"net/http"
"strings"
"os"
+ "regexp"
"github.com/hashicorp/hcl/v2"
"github.com/zclconf/go-cty/cty"
@@ -36,7 +37,6 @@ func NewEvalContext(request *http.Request, response *http.Response) *hcl.EvalCon
}
}
-
func newCtyEnvMap() cty.Value {
ctyMap := make(map[string]cty.Value)
for _, v := range os.Environ() {
@@ -51,16 +51,20 @@ func newCtyEnvMap() cty.Value {
func newCtyHeadersMap(headers http.Header) cty.Value {
ctyMap := make(map[string]cty.Value)
for k, v := range headers {
+ if isValidKey(k) {
ctyMap[k] = cty.StringVal(v[0]) // TODO: ListVal??
}
+ }
return cty.MapVal(ctyMap)
}
func newCtyParametersMap(parameters map[string]string) cty.Value {
ctyMap := make(map[string]cty.Value)
for k, v := range parameters {
+ if isValidKey(k) {
ctyMap[k] = cty.StringVal(v)
}
+ }
if len(ctyMap) == 0 {
return cty.MapValEmpty(cty.String)
@@ -68,6 +72,11 @@ func newCtyParametersMap(parameters map[string]string) cty.Value {
return cty.MapVal(ctyMap)
}
+func isValidKey(key string) bool {
+ valid, _ := regexp.MatchString("[a-zA-Z_][a-zA-Z0-9_-]*", key)
+ return valid
+}
+
// Functions
func newFunctionsMap() map[string]function.Function {
