influxdata-plugin-utils 0.2.0__tar.gz → 0.3.0__tar.gz

{influxdata_plugin_utils-0.2.0 → influxdata_plugin_utils-0.3.0}/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-31
+
+### Security
+
+- `config.load_plugin_config` — disable dynaconf's `@` token substitution
+  (`@read_file`, `@format`, `@jinja`, `@get`, and ~30 others) by constructing
+  the settings object with `AUTO_CAST_FOR_DYNACONF=False`. Previously any
+  string value beginning with `@` was evaluated, so an untrusted value from an
+  HTTP request body could read the server's files or environment variables
+  (for example `@read_file /etc/passwd` or `@format {env[SECRET]}`). Values are
+  now always treated as literal data. See
+  [#134](https://github.com/influxdata/influxdb3_plugins/issues/134).
+
+### Changed
+
+- Pin `dynaconf>=3.2,<4` so a future major release cannot silently re-enable
+  token substitution.
+
 ## [0.2.0] - 2026-07-12
 
 ### Added
@@ -39,6 +57,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `write` — `build_line`, `build_line_typed`, `add_field_with_type`,
   `write_data` (batching + retry), `BatchLines`.
 
-[Unreleased]: https://github.com/influxdata/influxdb3_plugins/compare/utils-v0.2.0...HEAD
+[Unreleased]: https://github.com/influxdata/influxdb3_plugins/compare/utils-v0.3.0...HEAD
+[0.3.0]: https://github.com/influxdata/influxdb3_plugins/compare/utils-v0.2.0...utils-v0.3.0
 [0.2.0]: https://github.com/influxdata/influxdb3_plugins/compare/utils-v0.1.0...utils-v0.2.0
 [0.1.0]: https://github.com/influxdata/influxdb3_plugins/releases/tag/utils-v0.1.0

{influxdata_plugin_utils-0.2.0 → influxdata_plugin_utils-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: influxdata-plugin-utils
-Version: 0.2.0
+Version: 0.3.0
 Summary: Shared helpers for InfluxDB 3 plugins.
 Project-URL: Homepage, https://github.com/influxdata/influxdb3_plugins
 Project-URL: Repository, https://github.com/influxdata/influxdb3_plugins
@@ -12,7 +12,7 @@ Keywords: influxdb,influxdb3,plugins
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3.11
 Requires-Python: >=3.11
-Requires-Dist: dynaconf>=3.2
+Requires-Dist: dynaconf<4,>=3.2
 Description-Content-Type: text/markdown
 
 # influxdata-plugin-utils

{influxdata_plugin_utils-0.2.0 → influxdata_plugin_utils-0.3.0}/pyproject.toml

@@ -12,7 +12,7 @@ license = "MIT OR Apache-2.0"
 license-files = ["LICENSE-MIT", "LICENSE-APACHE"]
 authors = [{ name = "InfluxData" }]
 keywords = ["influxdb", "influxdb3", "plugins"]
-dependencies = ["dynaconf>=3.2"]
+dependencies = ["dynaconf>=3.2,<4"]
 classifiers = [
     "Programming Language :: Python :: 3.11",
     "Operating System :: OS Independent",

{influxdata_plugin_utils-0.2.0 → influxdata_plugin_utils-0.3.0}/src/influxdata_plugin_utils/__init__.py

@@ -8,7 +8,7 @@ Modules:
     write          - LineBuilder builders and resilient write_data
 """
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 from . import cache, config, introspection, parsing, write
 from .cache import cached

{influxdata_plugin_utils-0.2.0 → influxdata_plugin_utils-0.3.0}/src/influxdata_plugin_utils/config.py

@@ -4,6 +4,11 @@ Loads a plugin's TOML config (resolved via the plugin directory), merges
 environment variables and engine-supplied ``args``, and validates the result.
 dynaconf is an implementation detail and must not leak into plugin code beyond
 the re-exported ``Validator``.
+
+All values are treated as literal data. dynaconf's ``@`` token substitution
+(``@read_file``, ``@format``, ``@get``, ...) is disabled so that a value
+beginning with ``@`` is never evaluated against the server's filesystem or
+environment; see https://github.com/influxdata/influxdb3_plugins/issues/134.
 """
 
 import os
@@ -104,8 +109,14 @@ def load_plugin_config(
             with open(resolve_path(config_file_path), "rb") as config_file:
                 layers.update(tomllib.load(config_file))
 
-    # loaders=[] disables the DYNACONF_* env loader; env is read only via env_keys
-    settings = Dynaconf(loaders=[])
+    # loaders=[] disables the DYNACONF_* env loader; env is read only via
+    # env_keys. AUTO_CAST_FOR_DYNACONF=False disables dynaconf's "@" token
+    # substitution (@read_file, @format, @jinja, @get, ... — ~30 tokens, each
+    # beginning with "@"). Without it, any string value that begins with "@" is
+    # evaluated instead of stored as data, so an untrusted value arriving in an
+    # HTTP request body could read the server's files or environment variables.
+    # See https://github.com/influxdata/influxdb3_plugins/issues/134.
+    settings = Dynaconf(loaders=[], AUTO_CAST_FOR_DYNACONF=False)
     settings.update(layers)
     if validators:
         settings.validators.register(*validators)