I'd suggest the rendering methods shouldn't be mixed directly into controllers and should instead be in a more isolated object, which would limit the amount of data being exposed.

It may be worth trying to get #inspect removed from safemode's default permitted methods due to its ability to expose instance variables.

I'd suggest the rendering methods shouldn't be mixed directly into controllers and should instead be in a more isolated object, which would limit the amount of data being exposed.

That would be really awesome, one can get inspiration in remote execution plugin which implements it's own renderer . The only downside is that it would be quite big change for a security fix since it involves both TemplatesController and UnattendedController. So to fix this I'd just disable inspect globally and as a second PR we could refactor rendering.

Marek Hulán wrote:

The only downside is that it would be quite big change for a security fix since it involves both TemplatesController and UnattendedController. So to fix this I'd just disable inspect globally and as a second PR we could refactor rendering.

Yes, I agree. If removing #inspect isn't possible or accepted, then we can just fix this in the next major version with a refactoring.

I looked into possibility to solve this in Foreman, but it's not nice at all: the problem is the inspect is allowed on the Safemode::Blankslate object
and there is not easy way to remove it form there: we would need to override the `inspect` method on the objects that are used by safemode, which
would affect their behaviour even outside of rendering.

Also, the problem is not just with the Safemode::Scope, but also with the Jail objects, where one can see attributes, that were not allowed in safemode.

Removing the inspect from the allowed methods seems like the best thing we can do right now.

I've opened a PR against safemode to address the issue https://github.com/svenfuchs/safemode/pull/17

safemode v1.2.4 that includes Ivan's fix was released today.