Skip to content

RUN-4579: Document sshExportQuoting control #1951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ronaveva wants to merge 1 commit into
base: 4.0.x
Choose a base branch
from
+15 −0
Open

RUN-4579: Document sshExportQuoting control #1951

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/administration/configuration/config-file-reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -602,6 +602,21 @@ Enables dynamic conditional execution in workflows based on runtime conditions.

**See also:** [User Management Guide](/manual/user-management/user-mgmt.md#manage-local-users)

#### SSH Exported Variable Quoting

**Purpose:** Optionally POSIX shell-quote the values exported to remote nodes via a node's `ssh-variable-export-pattern` attribute, to prevent command injection through those values (for example a job option value containing `;`, `$()`, or backticks).

| Property | Default | Description |
|----------|---------|-------------|
| `rundeck.execution.sshExportQuoting` | `false` | When `true`, values interpolated into a node's `ssh-variable-export-pattern` (the `export {key}={value}` prefix prepended to the remote SSH command) are shell-quoted before dispatch. |

**Behavior:**

- **Opt-in.** Default `false` preserves the current behavior; the control has no effect until enabled. System-level only (not per-project).
- When enabled, only values that contain whitespace or shell metacharacters are quoted — values without them are emitted unchanged, so typical configurations are unaffected.
- When enabling, node export patterns must reference `{value}` **without** surrounding quotes (e.g. `export {key}={value}`, not `export {key}='{value}'`). The framework performs the quoting; a self-quoting pattern would double-quote the value.
- Only nodes that define the (non-default) `ssh-variable-export-pattern` attribute are affected.

### Security HTTP Headers

**Purpose:** Add security headers to HTTP responses to protect against common web vulnerabilities.
Expand Down
Loading