From 250da0ab49d9f4a15a024dcd550537c3f187ad8e Mon Sep 17 00:00:00 2001 From: Megan Marsh Date: Mon, 13 Aug 2018 17:01:13 -0700 Subject: [PATCH] fix security hole with ami filter --- builder/amazon/common/run_config.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/builder/amazon/common/run_config.go b/builder/amazon/common/run_config.go index 9467d42bd..dbafd0f38 100644 --- a/builder/amazon/common/run_config.go +++ b/builder/amazon/common/run_config.go @@ -25,6 +25,10 @@ func (d *AmiFilterOptions) Empty() bool { return len(d.Owners) == 0 && len(d.Filters) == 0 } +func (d *AmiFilterOptions) NoOwner() bool { + return len(d.Owners) == 0 +} + // RunConfig contains configuration for running an instance from a source // AMI and details on how to access that launched image. type RunConfig struct { @@ -101,6 +105,10 @@ func (c *RunConfig) Prepare(ctx *interpolate.Context) []error { errs = append(errs, fmt.Errorf("A source_ami or source_ami_filter must be specified")) } + if c.SourceAmi == "" && c.SourceAmiFilter.NoOwner() { + errs = append(errs, fmt.Errorf("For security reasons, your source AMI filter must declare an owner.")) + } + if c.InstanceType == "" { errs = append(errs, fmt.Errorf("An instance_type must be specified")) }