[RUN-4693] Document job option injection controls - #1946
Open
ronaveva wants to merge 2 commits into
Open
Conversation
Document the opt-in option-value allowlist and the undeclared-option reject controls added under RUN-4693: - config-file-reference.md: new "Job Option Injection Controls" section under Security, covering rundeck.option.input.validation.default.pattern (system), project.option.input.validation.default.pattern (project), and rundeck.execution.rejectUndeclaredOptions, with precedence, a recommended starting pattern, and caveats (full-match, multi-line, fail-closed). - job-options.md: new "Restricting option input" section summarizing the three controls and linking to the full property reference. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds documentation for RUN-4693 job option input hardening features, describing how Rundeck can validate option values with a default allowlist regex and prevent unexpected/undeclared option input from reaching executions.
Changes:
- Adds a new “Restricting option input” section to the Job Options manual page, summarizing per-option restrictions plus the new default allowlist and undeclared-option rejection behaviors.
- Adds a new “Job Option Injection Controls” subsection under Security in the configuration file reference with properties, precedence, and pattern caveats.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| docs/manual/jobs/job-options.md | Introduces a user-facing overview section explaining how to restrict option input and links to the full configuration reference. |
| docs/administration/configuration/config-file-reference.md | Documents the new configuration properties, their scopes/defaults, and key behavior notes for option input validation and undeclared-option handling. |
Suppressed comments (1)
docs/administration/configuration/config-file-reference.md:636
- This row says the execution is “created and then failed at start”, but the surrounding text describes these as being rejected before any workflow step runs. Consider using consistent wording here (and avoid asserting creation if the intent is simply that it does not proceed).
| `rundeck.execution.rejectUndeclaredOptions` | `true` | When enabled, an execution that provides an option not defined on the job is created and then failed at start, with a message in the execution log. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
ronaveva
changed the title
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the option-injection controls added under RUN-4693 (product PR rundeck/rundeck#10490):
rundeck.option.input.validation.default.pattern(system) andproject.option.input.validation.default.pattern(project): an opt-in allowlist regex applied to option values that lack their own regex/enforced list. Includes precedence rules, a recommended starting pattern ([A-Za-z0-9 ]+), and caveats (full-match, multi-line via(?s), fail-closed on an invalid pattern).rundeck.execution.rejectUndeclaredOptions(defaulttrue): rejects executions that supply options not declared on the job.Changes
docs/administration/configuration/config-file-reference.md— new "Job Option Injection Controls" subsection under Security (full property reference).docs/manual/jobs/job-options.md— new "Restricting option input" section summarizing the three controls (per-option, default allowlist, reject undeclared) and linking to the reference.Note: the sink
expandTokensflag discussed during review was reverted and is intentionally not documented here.🤖 Generated with Claude Code