Add --safe-links to synchronize invocations
We don't want people to rsync files from outside the work dir by
creating symlinks and then synchronizing them. Pass in --safe-links to
rsync. rsync's behavior is that if --safe-links is present in the
presence of other options to the contrary that --safe-links will win.
Change-Id: I0e9657412edf20f0138d6fb7da994f4804f77826
diff --git a/zuul/ansible/action/synchronize.py b/zuul/ansible/action/synchronize.py
index 0193eca..88ca13a 100644
--- a/zuul/ansible/action/synchronize.py
+++ b/zuul/ansible/action/synchronize.py
@@ -26,6 +26,9 @@
dest = self._task.args.get('dest', None)
pull = self._task.args.get('pull', False)
+ if '--safe-links' not in self._task.args['rsync_opts']:
+ self._task.args['rsync_opts'].append('--safe-links')
+
if not pull and not paths._is_safe_path(source):
return paths._fail_dict(source, prefix='Syncing files from')
if pull and not paths._is_safe_path(dest):