Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently include arbitrary files/directories outside the local template clone location by using symlinks along with `_preserve_symlinks: false` (which is Copier's default setting). Version 9.11.2 patches the issue.
References
- https://github.com/copier-org/copier/security/advisories/GHSA-xjhm-gp88-8pfx x_refsource_CONFIRM
- https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 x_refsource_MISC
- https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 x_refsource_MISC
- https://github.com/copier-org/copier/security/advisories/GHSA-xjhm-gp88-8pfx x_refsource_CONFIRM
Affected products
- ==< 9.11.2
Matching in nixpkgs
pkgs.copier
Library and command-line utility for rendering projects templates
pkgs.apksigcopier
Copy/extract/patch android apk signatures & compare APKs
pkgs.gnomeExtensions.copier
Copy text notes to clipboard via a panel indicator
pkgs.python312Packages.copier
Library and command-line utility for rendering projects templates
pkgs.python313Packages.copier
Library and command-line utility for rendering projects templates
pkgs.python312Packages.copier-template-tester
ctt: CLI and pre-commit tool for testing copier
pkgs.python313Packages.copier-template-tester
ctt: CLI and pre-commit tool for testing copier
Package maintainers
-
@obfusk FC Stegerman <flx@obfusk.net>
-
@honnip Jung seungwoo <me@honnip.page>
-
@yajo Jairo Llopis <yajo.sk8@gmail.com>