Object parameters cannot be read from a file

[lbergnehr]

Describe the bug

According to

porter/docs/content/docs/bundle/manifest/_index.md

Line 182 in f61648f

porter install --param config=./config.json

,
an object parameter should, much like the file type parameter, be able to be
taken from a file directly when specified using the --param option in e.g.
porter install.

To Reproduce

Steps to reproduce the behavior:

1. Use this porter.yaml:

   schemaType: Bundle
   schemaVersion: 1.0.1
   name: porter-repro
   version: 0.1.0
   description: "An example Porter configuration"
   registry: "localhost:5000"
   
   # Declare and optionally configure the mixins used by the bundle
   mixins:
     - exec
   
   parameters:
     - name: object_parameter
       type: object
       path: /cnab/app/object_parameter.json
   
   # Define the steps that should execute when the bundle is installed
   install:
     - exec:
         description: "Install Hello World"
         command: echo
         arguments:
           - install ${ bundle.parameters.object_parameter }
   
   # Define the steps that should execute when the bundle is upgraded
   upgrade:
     - exec:
         description: "World 2.0"
         command: ./helpers.sh
         arguments:
           - upgrade
   
   # Define the steps that should execute when the bundle is uninstalled
   uninstall:
     - exec:
         description: "Uninstall Hello World"
         command: ./helpers.sh
         arguments:
           - uninstall

2. Put the following in object_parameter.json:

   {
     "key": "value"
   }

3. Run porter install --param object_parameter=./object_parameter.json

4. Observe the error:

   unable to convert parameter's object_parameter value ./object_parameter.json to the destination parameter type object: could not unmarshal value ./object_parameter.json into a json object: invalid character '.' looking for beginning of value
   

Expected behavior

The file should be read and marshalled into the object parameter
representation if the parameter given in the --param option is pointing to a
file.

Version

porter v1.2.0 (45c17c15)

[kichristensen]

@lbergnehr It sounds very sensible. Should be fairly easy to implement, in a way similar to what we do for files here,
https://github.com/getporter/porter/blob/main/pkg/porter/parameters.go#L647.

[kichristensen]

I've been looking into this, and it requires some further consideration. Supporting the described use case is relatively straightforward, but only if we allow access to files both when specified directly in the Porter manifest and when overridden via the command line.

However, there are security implications if this behavior is permitted as a default value in the manifest. It would enable bundle authors to read files from the user's machine without their explicit knowledge. One possible mitigation could be to restrict access to files within the current directory or its subdirectories, but even that introduces potential security concerns.

I believe the safest and most transparent approach would be to only allow this behavior when the parameter is explicitly set via the command line.

What do you think @dgannon991 and @lbergnehr?

[lbergnehr]

Great job! I agree with those security concerns. What do you think about allowing it in parameter sets as well, i.e. using source.path?

[dgannon991]

Hi Kim,
Sorry, I managed to miss this one. Yes that sounds sensible, I agree with your concerns, it would be all too easy for people to misuse this.

[kichristensen]

Great job! I agree with those security concerns. What do you think about allowing it in parameter sets as well, i.e. using source.path?

Sorry for the late reply. That would make sense, as it is still something that is controlled by the user invoking the bundle.

[kichristensen]

I will continue with this issue, and let you know my findings.

[lbergnehr]

I agree with the above. 😄