Are there any options for limiting form erb by app path or type? Use-case I’m thinking of is with Shared Apps, where currently the maintainers need to have a relatively high level of trust on the system because any form erb code will be executed by any user who has read access to it. Actual app functionality in the script when run is a different story but in this case no action would need to be taken by the user other than logging into the system.
I can’t find anything that would do that, but we could certainly look into adding it in the next version. In general I would caution that plenty of apps rely on benign ERB code so disabling form ERB would significantly limit what usr apps would be capable of altogether. But that would just have to be worked out between the admin and app developers.
where currently the maintainers need to have a relatively high level of trust on the system because any form erb code will be executed by any user who has read access to it.
That’s definitely true, and this can be somewhat mitigated by giving only a small set of users read access, typically within the same group or team (also since team-specific applications are the best use case of usr apps, since they would probably not ever be promoted to system apps). Though at the end of the day the only way to fully avoid the risks of usr apps is to just disable them and force developers to share source code rather than executables. That at least adds an extra step so that each user can review the code before deploying an update. To share an app with a user who isn’t a developer, they would have to go through you (the admin) to add it to the system apps, where it could still be limited to a given group or team by setting permissions.
Actual app functionality in the script when run is a different story but in this case no action would need to be taken by the user other than logging into the system.
This is a reasonable concern, and something we can definitely look into fixing. It seems to me that usr apps should probably load lazily by default, so that any ERB is only evaluated when the app is actually selected. I think that would align more closely with users’ expectations of what should happen (‘this app won’t do anything until I select it’) and also make it more accountable, since it would be easy to know which app was responsible if something did happen. Though I would have to look into how feasible this behavior is, as I recall that individual apps do not currently know whether they are sys, usr, or dev, so it may be challenging to implement. I have opened Add configuration to disable ERB on `usr` apps · Issue #5796 · OSC/ondemand · GitHub and `usr` apps should load ERB lazily · Issue #5797 · OSC/ondemand · GitHub to track these issues. Thanks for bringing this to our attention!