-
Notifications
You must be signed in to change notification settings - Fork 25
Closed
Description
We currently pass manifests to SDM in a special config key __injected_declarative_manifest
.
This proposal would add three new special config keys:
__injected_components_py
(str
): Optional. The full text of acomponents.py
file.__injected_components_py_sha256
(str
): Optional. Hash of thecomponents.py
text file. When provided, it will be validated against the__injected_components_py
contents. Execution will abort if the checksum does not match.__allowed_hosts
(list[str]
): Optional. List of hosts to which the connector should restrict outgoing traffic. When provided, outgoing http requests will not be allowed if they are outside of these allowed hosts.
This would be backwards compatible and not requiring any new capabilities in the platform. This makes our config.json
contents much larger, but otherwise it doesn't break anything or open up new vulnerabilities.
Note:
- Note that
__allowed_hosts
can optionally be deprioritized and moved into a separate issue. In terms of effort, there is not much overlap in functionality between the ability to run custom code and the ability to restict network traffic. The higher priority is being able to run custom python code from SDM.
Metadata
Metadata
Assignees
Labels
No labels