Relax type check and add comments about validation

Doug Greiman · Doug Greiman · commit c24977b57fff · 2017-06-21T14:11:21.000-07:00
diff --git a/scripts/gen_dockerfile.py b/scripts/gen_dockerfile.py
@@ -18,6 +18,7 @@
 
 import argparse
 import collections
+import collections.abc
 import functools
 import io
 import os
@@ -73,13 +74,25 @@ def get_app_config(raw_config, base_image, config_file, source_dir):
         config_file (str): Path to user's app.yaml (might be <service-name>.yaml)
         source_dir (str): Directory container user's source code
 
+    We validate the user input for security and better error messages.
+
+    Yaml parsing rules can lead to extremely unhelpful error messages.
+    For example, parsing a string value where we expected a list.
+    Python will happily use the string as a sequence of individual
+    characters, leading to confusing results.
+
+    We also try to prevent Dockerfile and Bash injection attacks.  For
+    example, specifying entrypoint as "true\\nADD /etc/passwd /pwned"
+    would allow the user to inject arbitrary directives into the
+    Dockerfile, which is a support problem if nothing else.
+
     Returns:
         AppConfig: valid configuration
     """
     # Examine app.yaml
-    if not isinstance(raw_config, dict):
+    if not isinstance(raw_config, collections.abc.Mapping):
         raise ValueError(
-            'Expected {} contents to be of type "dict", but found type "{}"'.
+            'Expected {} contents to be a Mapping type, but found type "{}"'.
             format(config_file, type(raw_config)))
 
     entrypoint = validation_utils.get_field_value(raw_config, 'entrypoint', str)
@@ -117,7 +130,18 @@ def get_app_config(raw_config, base_image, config_file, source_dir):
 
 
 def get_data(name):
-    """Return the contents of the named data resource"""
+    """Return the contents of the named data resource
+
+    Args:
+        name (str): Name of file, without directory
+
+    These templates are copied from the Google Cloud SDK at
+    google-cloud-sdk/platform/ext-runtime/python/data
+    and the two should be kept in sync.
+
+    Returns:
+        str: Contents of data file
+    """
     filename = os.path.join(os.path.dirname(__file__), 'data', name)
     with io.open(filename, 'r', encoding='utf8') as template_file:
         return template_file.read()
