{"record":{"id":"0c4ed8efb5de252e","repo":"ory/hydra","slug":"import-not-available-v","errorCode":null,"errorMessage":"import not available %v","messagePattern":"import not available (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/jsonnet.go","lineNumber":127,"sourceCode":"// MakeInProcessVM returns a Jsonnet VM that evaluates in the calling process\n// with imports disabled. It provides no isolation: a malicious or buggy snippet\n// can exhaust this process's memory and CPU, so it is only safe for trusted\n// input. The two legitimate uses are the jsonnet subcommand, which is itself\n// the isolation boundary, and offline CLI linting. Everything that evaluates\n// tenant-supplied Jsonnet must use MakeSecureVM.\nfunc MakeInProcessVM() *jsonnet.VM {\n\tvm := jsonnet.MakeVM()\n\tvm.Importer(new(ErrorImporter))\n\treturn vm\n}\n\n// ErrorImporter errors when calling \"import\".\ntype ErrorImporter struct{}\n\n// Import fetches data from a map entry.\n// All paths are treated as absolute keys.\nfunc (importer *ErrorImporter) Import(importedFrom, importedPath string) (contents jsonnet.Contents, foundAt string, err error) {\n\treturn jsonnet.Contents{}, \"\", fmt.Errorf(\"import not available %v\", importedPath)\n}\n\nfunc JsonnetTestBinary(t testing.TB) string {\n\tt.Helper()\n\n\t// We can force the usage of a given jsonnet executable.\n\t// Useful to test different versions, or run the tests under wine.\n\tif s := os.Getenv(\"ORY_JSONNET_PATH\"); s != \"\" {\n\t\treturn s\n\t}\n\n\tvar stderr bytes.Buffer\n\t// Using `t.TempDir()` results in permissions errors on Windows, sometimes.\n\toutPath := path.Join(os.TempDir(), \"jsonnet\")\n\tif runtime.GOOS == \"windows\" {\n\t\toutPath = outPath + \".exe\"\n\t}\n\tcmd := exec.Command(\"go\", \"build\", \"-o\", outPath, \"github.com/ory/x/jsonnetsecure/cmd\")","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/jsonnet.go#L109-L145","documentation":"jsonnetsecure.ErrorImporter is an importer that intentionally fails every \"import\" statement in evaluated Jsonnet code, returning this error with the requested path. It is used to sandbox evaluation so Jsonnet files cannot pull in other files.","triggerScenarios":"Evaluating Jsonnet source that contains import '...' or importstr '...' while the VM is configured with ErrorImporter (the default secure setup) — any import attempt, even of absolute-looking paths, triggers it.","commonSituations":"Vendor libraries or templates that use import internally while the host uses jsonnetsecure with imports disabled; running JsonnetTestBinary-based tests on code with imports; migration from plain jsonnet to the secured VM.","solutions":["Remove/inline import statements from the Jsonnet source, or pass all data as top-level arguments/ext vars","Supply a real importer (e.g. a FileImporter scoped to an allowed directory) instead of ErrorImporter if imports must work","Pre-resolve imported files and pass their contents to the VM yourself"],"exampleFix":"// before\nvm.Importer(&jsonnetsecure.ErrorImporter{}) // code does import 'lib.libsonnet'\n// after\nvm.Importer(&jsonnet.FileImporter{JPaths: []string{\"/safe/vendor\"}})","handlingStrategy":"try-catch","validationCode":"// Pre-scan Jsonnet source for imports before secure evaluation\nfunc hasImports(source string) bool {\n    return strings.Contains(source, \"import \") || strings.Contains(source, \"importstr \")\n}","typeGuard":null,"tryCatchPattern":"out, err := vm.EvaluateAnonymousSnippet(\"config.jsonnet\", source)\nif err != nil && strings.Contains(err.Error(), \"import not available\") {\n    return nil, fmt.Errorf(\"jsonnet config uses imports but secure evaluation forbids them: %w\", err)\n}","preventionTips":["Vendor/inline all imported Jsonnet files before secure evaluation","Pass external data via ext vars (vm.ExtCode) instead of imports","Only attach a permissive FileImporter when the directory whitelist is deliberate","Add CI checks that flag import statements in Jsonnet shipped for secure evaluation"],"tags":["jsonnet","import","sandbox","go"],"backgroundTag":"import-not-allowed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}