You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We currently pass manifests to SDM in a special config key __injected_declarative_manifest.
This proposal would add three new special config keys:
__injected_components_py (str): Optional. The full text of a components.py file.
__injected_components_py_sha256 (str): Optional. Hash of the components.py text file. When provided, it will be validated against the __injected_components_py contents. Execution will abort if the checksum does not match.
__allowed_hosts (list[str]): Optional. List of hosts to which the connector should restrict outgoing traffic. When provided, outgoing http requests will not be allowed if they are outside of these allowed hosts.
This would be backwards compatible and not requiring any new capabilities in the platform. This makes our config.json contents much larger, but otherwise it doesn't break anything or open up new vulnerabilities.
Note:
Note that __allowed_hosts can optionally be deprioritized and moved into a separate issue. In terms of effort, there is not much overlap in functionality between the ability to run custom code and the ability to restict network traffic. The higher priority is being able to run custom python code from SDM.
The text was updated successfully, but these errors were encountered:
We currently pass manifests to SDM in a special config key
__injected_declarative_manifest
.This proposal would add three new special config keys:
__injected_components_py
(str
): Optional. The full text of acomponents.py
file.__injected_components_py_sha256
(str
): Optional. Hash of thecomponents.py
text file. When provided, it will be validated against the__injected_components_py
contents. Execution will abort if the checksum does not match.__allowed_hosts
(list[str]
): Optional. List of hosts to which the connector should restrict outgoing traffic. When provided, outgoing http requests will not be allowed if they are outside of these allowed hosts.This would be backwards compatible and not requiring any new capabilities in the platform. This makes our
config.json
contents much larger, but otherwise it doesn't break anything or open up new vulnerabilities.Note:
__allowed_hosts
can optionally be deprioritized and moved into a separate issue. In terms of effort, there is not much overlap in functionality between the ability to run custom code and the ability to restict network traffic. The higher priority is being able to run custom python code from SDM.The text was updated successfully, but these errors were encountered: