{"record":{"id":"04a2004297a617db","repo":"jumpserver/jumpserver","slug":"playbook-contains-dangerous-keywords","errorCode":null,"errorMessage":"Playbook contains dangerous keywords","messagePattern":"Playbook contains dangerous keywords","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"apps/ops/models/job.py","lineNumber":544,"sourceCode":"                    break\n        command = self.current_job.args\n        if command and set(command.split()).intersection(set(settings.SECURITY_COMMAND_BLACKLIST)):\n            CommandExecutionAlert({\n                \"assets\": self.current_job.assets.all(),\n                \"input\": self.material,\n                \"risk_level\": RiskLevelChoices.reject,\n                \"user\": self.creator,\n            }).publish_async()\n            raise CommandInBlackListException(\n                \"Command is rejected by black list: {}\".format(self.current_job.args))\n\n    def check_danger_keywords(self):\n        lines = self.job.playbook.check_dangerous_keywords()\n        if len(lines) > 0:\n            for line in lines:\n                print('\\033[31mThe {} line of the file \\'{}\\' contains the '\n                      'dangerous keyword \\'{}\\'\\033[0m'.format(line['line'], line['file'], line['keyword']))\n            raise Exception(\"Playbook contains dangerous keywords\")\n\n    def check_assets_perms(self):\n        all_permed_assets = UserPermAssetUtil(self.creator).get_all_assets()\n        has_permed_assets = set(self.current_job.assets.all()) & set(all_permed_assets)\n\n        error_assets_count = 0\n        for asset in self.current_job.assets.all():\n            if asset not in has_permed_assets:\n                print(\"\\033[31mAsset {}({}) has no access permission\\033[0m\".format(asset.name, asset.address))\n                error_assets_count += 1\n\n        if error_assets_count > 0:\n            raise Exception(\"You do not have access rights to {} assets\".format(error_assets_count))\n\n    def check_data_masking_rules_acls(self):\n        for asset in self.current_job.assets.all():\n            acls = DataMaskingRule.filter_queryset(\n                user=self.creator,","sourceCodeStart":526,"sourceCodeEnd":562,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/ops/models/job.py#L526-L562","documentation":"Raised by check_danger_keywords when the playbook's files contain any line matching configured dangerous keywords (playbook.check_dangerous_keywords() returns hits). All matching lines are printed to the log with file/line/keyword before the exception aborts the job. Only checked for type == 'playbook'.","triggerScenarios":"Starting a playbook job whose uploaded playbook files contain a configured dangerous keyword; check_assets_acls calls check_danger_keywords before execution.","commonSituations":"Security-hardened deployments with DANGER_KEYWORDS settings; playbooks that legitimately use flagged words (e.g. 'rm ', 'chmod 777') in shell tasks; keywords added by an admin after the playbook was written.","solutions":["Check the job/task log: each offending file, line number and keyword is printed — edit the playbook to remove or rephrase those lines","Ask the admin whether the keyword list (settings) is too broad and should be refined","Upload the corrected playbook and rerun the job"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"hits = playbook.check_dangerous_keywords()\nif hits:\n    reject_upload('dangerous keywords: %s' % hits)","typeGuard":null,"tryCatchPattern":"try:\n    job.start()\nexcept Exception as e:\n    if 'dangerous keywords' in str(e): flag_playbook_for_review()","preventionTips":["Run keyword check at playbook upload time, not just job start","Document the active keyword list for playbook authors"],"tags":["playbook","dangerous-keywords","security","static-analysis"],"backgroundTag":"dangerous-content-rejected","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}