Move jq_filter in content_guard behind a feature flag

CHANGES/+CVE-2026-123084.bugfix

@@ -0,0 +1 @@
+Disabled complex `jq_filter` programs in `HeaderContentGuard` by default. Simple dotted paths continue to work. Use `settings.ALLOW_INSECURE_HEADER_CONTENT_GUARD_JQ_PROCESSING_AND_FORFEIT_ALL_COMMUNITY_SUPPORT` if you __need__ to use it. CVE-2026-123084

pulpcore/app/models/publication.py

@@ -7,10 +7,10 @@
 from base64 import b64decode
 from binascii import Error as Base64DecodeError
 from datetime import timedelta
+from functools import reduce
 from gettext import gettext as _
 from urllib.parse import urljoin, urlparse
 
-import jq
 from aiohttp.web_exceptions import HTTPNotFound
 from django.conf import settings
 from django.contrib.postgres.fields import HStoreField
@@ -35,6 +35,13 @@
 
 _logger = logging.getLogger(__name__)
 
+if settings.ALLOW_INSECURE_HEADER_CONTENT_GUARD_JQ_PROCESSING_AND_FORFEIT_ALL_COMMUNITY_SUPPORT:  # noqa
+    import jq
+else:
+    # Match a dotted identifier path.
+    # e.g.: "tenant.auth.token"
+    json_path_re = re.compile(r"(?:\.\w+)+", flags=re.ASCII)
+
 
 class PublicationQuerySet(models.QuerySet):
     """A queryset that provides publication filtering methods."""
@@ -544,12 +551,32 @@ def permit(self, request):
 
         if self.jq_filter:
             try:
-                header_value = json.loads(header_decoded_content)
-                json_path = jq.compile(self.jq_filter)
+                header_json = json.loads(header_decoded_content)
+                if settings.ALLOW_INSECURE_HEADER_CONTENT_GUARD_JQ_PROCESSING_AND_FORFEIT_ALL_COMMUNITY_SUPPORT:  # noqa
+                    # DISCLAIMER:
+                    # The prelude attempts to strip the environment from the jq srcipt.
+                    # That does not mean it is safe to allow users to define a script to run on
+                    # the content app.
+                    JQ_PRELUDE = r"def env: {}; {} as $ENV |"
+                    json_path = jq.compile(
+                        f"{JQ_PRELUDE} {self.jq_filter}",
+                        args={
+                            "JQ_BUILD_CONFIGURATION": "",
+                            "ARGS": {"positional": [], "named": {}},
+                        },
+                    )
 
-                header_value = json_path.input_value(header_value).first()
+                    header_value = json_path.input_value(header_json).first()
 
-            except json.JSONDecodeError:
+                elif json_path_re.fullmatch(self.jq_filter):
+                    path = self.jq_filter.lstrip(".").split(".")
+                    header_value = reduce(lambda x, y: x[y], path, header_json)
+                else:
+                    _logger.warning(
+                        "Using 'jq_filter' is only allowed with simple paths on this installation."
+                    )
+                    raise PermissionError(_("ContentGuard misconfigured."))
+            except (TypeError, KeyError, json.JSONDecodeError):
                 _logger.debug("Access not allowed - Invalid JSON or Path not found.")
                 raise PermissionError(_("Access denied."))
         else:

pulpcore/app/serializers/__init__.py

@@ -47,6 +47,7 @@
     relative_path_validator,
     TaskGroupStatusCountField,
     pulp_labels_validator,
+    RegexValidator,
 )
 from .access_policy import AccessPolicySerializer
 from .acs import (

pulpcore/app/serializers/fields.py

@@ -28,6 +28,17 @@ def relative_path_validator(relative_path):
     return relative_path
 
 
+class RegexValidator:
+    def __init__(self, regex, flags=0):
+        self.pattern = re.compile(regex, flags)
+
+    def __call__(self, value):
+        if not self.pattern.fullmatch(value):
+            raise serializers.ValidationError(
+                _("Value does not match pattern r'{}'.").format(self.pattern.pattern)
+            )
+
+
 class RelativePathField(serializers.CharField):
     """
     Serializer Field for the base_url field of the Distribution.

pulpcore/app/serializers/publication.py

@@ -1,3 +1,4 @@
+import re
 from gettext import gettext as _
 
 from django.conf import settings
@@ -14,6 +15,7 @@
     DomainUniqueValidator,
     GetOrCreateSerializerMixin,
     ModelSerializer,
+    RegexValidator,
     RelativePathField,
     RepositoryVersionRelatedField,
     pulp_labels_validator,
@@ -161,14 +163,23 @@ class HeaderContentGuardSerializer(ContentGuardSerializer, GetOrCreateSerializer
     jq_filter = serializers.CharField(
         help_text=_(
             (
-                "A JQ syntax compatible filter. If jq_filter is not set, then the value will"
-                "only be Base64 decoded and checked as an explicit string match."
+                "A simple dotted path (e.g. .a.b.c) used to extract the value from the "
+                "Base64 decoded JSON header. If jq_filter is not set, the header value "
+                "is only Base64 decoded and checked as an explicit string match."
             )
         ),
         allow_null=True,
         required=False,
     )
 
+    def validate_jq_filter(self, value):
+        if (
+            value is not None
+            and not settings.ALLOW_INSECURE_HEADER_CONTENT_GUARD_JQ_PROCESSING_AND_FORFEIT_ALL_COMMUNITY_SUPPORT
+        ):  # noqa
+            RegexValidator(r"(?:\.\w+)+", re.ASCII)(value)
+        return value
+
     class Meta(ContentGuardSerializer.Meta):
         model = models.HeaderContentGuard
         fields = ContentGuardSerializer.Meta.fields + ("header_name", "header_value", "jq_filter")

pulpcore/app/settings.py

@@ -456,6 +456,11 @@
 # Replaces every non PulpException error msg with "An internal error occured"
 REDACT_UNSAFE_EXCEPTIONS = False
 
+# JQ is a query language after all. And it should be considered on the same level as SQL.
+# Do not allow users to write arbitrary programs to run on the content app.
+# Exposes to at least CVE-2026-123084.
+ALLOW_INSECURE_HEADER_CONTENT_GUARD_JQ_PROCESSING_AND_FORFEIT_ALL_COMMUNITY_SUPPORT = False
+
 # HERE STARTS DYNACONF EXTENSION LOAD (Keep at the very bottom of settings.py)
 # Read more at https://www.dynaconf.com/django/