Skip to content

Commit 63e1381

Browse files
bordeuxbordeux
authored
Merge pull request #12 from bordeux/feature/improvements-next-stage
chore: Add github required files
2 parents f2cb5ec + a8d97cf commit 63e1381

10 files changed

Lines changed: 3305 additions & 1395 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
name: Bug Report
3+
about: Report a bug or unexpected behavior
4+
title: '[BUG] '
5+
labels: bug
6+
assignees: ''
7+
---
8+
9+
## Bug Description
10+
11+
A clear and concise description of what the bug is.
12+
13+
## Steps to Reproduce
14+
15+
1. Create a template with '...'
16+
2. Run command '....'
17+
3. See error
18+
19+
## Expected Behavior
20+
21+
A clear and concise description of what you expected to happen.
22+
23+
## Actual Behavior
24+
25+
A clear and concise description of what actually happened.
26+
27+
## Minimal Reproducible Example
28+
29+
**Template** (`example.tmpl`):
30+
```
31+
# Paste your template here
32+
```
33+
34+
**Command:**
35+
```bash
36+
# Paste the exact command you ran
37+
tmpltool example.tmpl
38+
```
39+
40+
**Environment Variables (if applicable):**
41+
```bash
42+
# List any environment variables you set
43+
export VAR_NAME="value"
44+
```
45+
46+
**Output/Error:**
47+
```
48+
# Paste the actual output or error message
49+
```
50+
51+
## Environment
52+
53+
- **tmpltool version:** [e.g., 1.2.0] (run `tmpltool --version`)
54+
- **OS:** [e.g., Ubuntu 22.04, macOS 14.0, Windows 11]
55+
- **Installation method:** [e.g., GitHub releases, Docker, built from source]
56+
- **Docker version (if applicable):** [e.g., 24.0.5]
57+
58+
## Additional Context
59+
60+
Add any other context about the problem here. For example:
61+
- Does it work with `--trust` flag?
62+
- Does it happen only with specific file types?
63+
- Screenshots, if applicable
64+
- Related issues or discussions
65+
66+
## Possible Solution (Optional)
67+
68+
If you have an idea of how to fix this, please describe it here.

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Question or Discussion
4+
url: https://github.com/bordeux/tmpltool/discussions
5+
about: Ask questions or discuss ideas in GitHub Discussions
6+
- name: Tera Template Engine Docs
7+
url: https://keats.github.io/tera/docs/
8+
about: Official Tera template engine documentation

‎.github/ISSUE_TEMPLATE/documentation.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
name: Documentation Issue
3+
about: Report missing, unclear, or incorrect documentation
4+
title: '[DOCS] '
5+
labels: documentation
6+
assignees: ''
7+
---
8+
9+
## Documentation Issue
10+
11+
**What part of the documentation is affected?**
12+
- [ ] README.md
13+
- [ ] Function reference
14+
- [ ] Examples
15+
- [ ] Code comments
16+
- [ ] Contributing guide
17+
- [ ] Other: _____________
18+
19+
**Link or section:**
20+
Provide a link or describe which section of the documentation is affected.
21+
22+
## Problem
23+
24+
Describe what's missing, unclear, or incorrect in the documentation.
25+
26+
**Current documentation:**
27+
```
28+
# Quote or describe the current documentation
29+
```
30+
31+
**What's wrong with it:**
32+
- [ ] Missing information
33+
- [ ] Incorrect information
34+
- [ ] Unclear/confusing
35+
- [ ] Out of date
36+
- [ ] Broken link
37+
- [ ] Typo/grammar
38+
- [ ] Other: _____________
39+
40+
## Suggested Improvement
41+
42+
**What should be added/changed:**
43+
```
44+
# Describe or provide the corrected documentation
45+
```
46+
47+
**Why this is important:**
48+
Explain why this documentation improvement matters (e.g., helps new users, clarifies confusion, etc.)
49+
50+
## Additional Context
51+
52+
Add any other context, screenshots, or examples here.
53+
54+
## Willingness to Contribute
55+
56+
- [ ] I'm willing to submit a PR to fix this documentation
57+
- [ ] I'm just reporting the issue

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
name: Feature Request
3+
about: Suggest a new feature or enhancement
4+
title: '[FEATURE] '
5+
labels: enhancement
6+
assignees: ''
7+
---
8+
9+
## Feature Description
10+
11+
A clear and concise description of the feature you'd like to see.
12+
13+
## Problem or Use Case
14+
15+
**Is your feature request related to a problem?**
16+
Describe the problem or limitation you're facing. For example:
17+
- "I'm always frustrated when..."
18+
- "It's difficult to..."
19+
- "I need to manually..."
20+
21+
**What are you trying to accomplish?**
22+
Describe your use case and why this feature would be valuable.
23+
24+
## Proposed Solution
25+
26+
Describe the solution you'd like. How should this feature work?
27+
28+
**Example usage:**
29+
```bash
30+
# Show how you'd like to use this feature
31+
tmpltool --new-flag template.tmpl
32+
```
33+
34+
**Example template:**
35+
```
36+
{# Show template syntax if applicable #}
37+
{{ new_function(arg="value") }}
38+
```
39+
40+
**Expected output:**
41+
```
42+
# What output do you expect?
43+
```
44+
45+
## Alternatives Considered
46+
47+
Describe any alternative solutions or features you've considered.
48+
49+
## Additional Context
50+
51+
Add any other context, screenshots, or examples about the feature request here.
52+
53+
**Related to:**
54+
- [ ] New custom function
55+
- [ ] New command-line option
56+
- [ ] Improvement to existing feature
57+
- [ ] Documentation enhancement
58+
- [ ] Performance improvement
59+
- [ ] Other (please describe)
60+
61+
## Priority
62+
63+
How important is this feature to you?
64+
- [ ] Critical - Blocking my workflow
65+
- [ ] High - Would significantly improve my workflow
66+
- [ ] Medium - Nice to have
67+
- [ ] Low - Small improvement
68+
69+
## Willingness to Contribute
70+
71+
- [ ] I'm willing to submit a PR for this feature
72+
- [ ] I can help with testing
73+
- [ ] I can help with documentation
74+
- [ ] I'm just suggesting the idea

‎.github/SECURITY.md‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We release security updates for the following versions:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 1.2.x | :white_check_mark: |
10+
| 1.1.x | :white_check_mark: |
11+
| 1.0.x | :x: |
12+
| < 1.0 | :x: |
13+
14+
## Reporting a Vulnerability
15+
16+
**Please do not report security vulnerabilities through public GitHub issues.**
17+
18+
If you discover a security vulnerability in tmpltool, please report it by emailing the maintainers. You can find the contact information in the repository.
19+
20+
### What to Include
21+
22+
Please include the following information in your report:
23+
24+
- **Description** of the vulnerability
25+
- **Steps to reproduce** the issue
26+
- **Potential impact** of the vulnerability
27+
- **Suggested fix** (if you have one)
28+
- **Your contact information** for follow-up
29+
30+
### Response Timeline
31+
32+
- **Initial Response:** We aim to respond to security reports within 48 hours
33+
- **Confirmation:** We will confirm the vulnerability within 5 business days
34+
- **Fix Timeline:** We will work on a fix and aim to release a patch within 14 days for critical vulnerabilities
35+
- **Disclosure:** We will coordinate with you on the disclosure timeline
36+
37+
## Security Best Practices for tmpltool
38+
39+
When using tmpltool, please follow these security best practices:
40+
41+
### 1. Trust Mode (`--trust`)
42+
43+
**⚠️ WARNING:** Only use `--trust` mode with templates you completely trust.
44+
45+
```bash
46+
# ✗ DANGEROUS - Don't use --trust with untrusted templates
47+
tmpltool --trust untrusted_template.tmpl
48+
49+
# ✓ SAFE - Use without --trust for untrusted templates
50+
tmpltool untrusted_template.tmpl
51+
```
52+
53+
**Why?** Trust mode disables security restrictions:
54+
- Can read any file on the system (e.g., `/etc/passwd`, SSH keys)
55+
- Can access parent directories (`../`)
56+
- Can read sensitive configuration files
57+
58+
**Only use `--trust` when:**
59+
- You wrote the template yourself
60+
- You've reviewed and audited the template
61+
- You trust the template source completely
62+
- You need to access system files intentionally
63+
64+
### 2. Template Security
65+
66+
**Avoid processing untrusted templates without review:**
67+
68+
```bash
69+
# ✗ DANGEROUS - Don't process templates from untrusted sources
70+
curl https://untrusted-site.com/template.tmpl | tmpltool
71+
72+
# ✓ SAFE - Review templates before using them
73+
curl https://trusted-site.com/template.tmpl -o template.tmpl
74+
# Review the template
75+
cat template.tmpl
76+
# Then use it
77+
tmpltool template.tmpl
78+
```
79+
80+
**What to check in templates:**
81+
- File system access attempts
82+
- Unexpected environment variable usage
83+
- Suspicious patterns or obfuscation
84+
85+
### 3. Environment Variables
86+
87+
**Be careful with sensitive environment variables:**
88+
89+
```bash
90+
# ✗ DANGEROUS - Don't expose secrets in environment
91+
export DATABASE_PASSWORD="secret123"
92+
tmpltool template.tmpl # Template could leak this
93+
94+
# ✓ BETTER - Use secure secret management
95+
# Load secrets only when needed and clear them after use
96+
```
97+
98+
**Best practices:**
99+
- Don't put secrets in environment variables if possible
100+
- Use dedicated secret management tools
101+
- Clear sensitive env vars after use
102+
- Review templates for `filter_env(pattern="*")` which could expose all env vars
103+
104+
### 4. Filesystem Access
105+
106+
**Default security (without `--trust`):**
107+
- ✓ Only relative paths allowed
108+
- ✓ No access to parent directories (`..`)
109+
- ✓ No absolute paths (`/etc/passwd`)
110+
- ✓ Restricted to current working directory
111+
112+
**With `--trust` mode:**
113+
- ⚠️ Full filesystem access
114+
- ⚠️ Can read any file the user can access
115+
- ⚠️ No restrictions
116+
117+
### 5. Docker Security
118+
119+
When using Docker:
120+
121+
```bash
122+
# ✓ SAFE - Mount only necessary directories
123+
docker run --rm -v $(pwd):/workspace -w /workspace tmpltool template.tmpl
124+
125+
# ✗ DANGEROUS - Don't mount entire filesystem
126+
docker run --rm -v /:/host tmpltool template.tmpl
127+
```
128+
129+
## Known Security Considerations
130+
131+
### 1. Template Injection
132+
133+
tmpltool uses the Tera template engine. While Tera is designed to be safe, be aware that:
134+
- Templates have access to environment variables via `get_env()`
135+
- Templates can read files via filesystem functions
136+
- Trust mode disables all security restrictions
137+
138+
### 2. Filesystem Access
139+
140+
Filesystem functions enforce security by default:
141+
- `read_file()` - Restricted to relative paths
142+
- `file_exists()` - Restricted to relative paths
143+
- `list_dir()` - Restricted to relative paths
144+
- `glob()` - Restricted to current directory
145+
146+
Use `--trust` only when necessary and with caution.
147+
148+
### 3. Environment Variable Exposure
149+
150+
Functions like `filter_env(pattern="*")` can expose all environment variables. Review templates carefully to ensure they don't leak sensitive information.
151+
152+
## Security Updates
153+
154+
Security updates will be:
155+
1. Developed privately
156+
2. Tested thoroughly
157+
3. Released as patch versions (e.g., 1.2.1)
158+
4. Announced in release notes with `[SECURITY]` tag
159+
5. Added to this SECURITY.md file
160+
161+
## Security Hall of Fame
162+
163+
We'd like to thank the following people for responsibly disclosing security issues:
164+
165+
<!-- Names will be added here as vulnerabilities are reported and fixed -->
166+
167+
---
168+
169+
**Remember:** Security is everyone's responsibility. If you see something, say something!

0 commit comments

Comments
 (0)