[core] Restrict raw access to stringmap underlying structure

core/server.go

@@ -250,9 +250,10 @@ func (m *RpcServer) GetEnvironments(cxt context.Context, request *pb.GetEnvironm
 		var defaults, vars, userVars map[string]string
 		defaults, vars, userVars, err = env.Workflow().ConsolidatedVarMaps()
 		if err != nil {
-			defaults = env.GlobalDefaults.Raw()
-			vars = env.GlobalVars.Raw()
-			userVars = env.UserVars.Raw()
+			// take raw of copy, not raw of original because the actual varstack is mutex protected
+			defaults = env.GlobalDefaults.RawCopy()
+			vars = env.GlobalVars.RawCopy()
+			userVars = env.UserVars.RawCopy()
 		}
 
 		isEnvData, ok := integratedServicesEnvsData[id]
@@ -378,9 +379,9 @@ func (m *RpcServer) NewEnvironment(cxt context.Context, request *pb.NewEnvironme
 	var defaults, vars, userVars map[string]string
 	defaults, vars, userVars, err = newEnv.Workflow().ConsolidatedVarMaps()
 	if err != nil {
-		defaults = newEnv.GlobalDefaults.Raw()
-		vars = newEnv.GlobalVars.Raw()
-		userVars = newEnv.UserVars.Raw()
+		defaults = newEnv.GlobalDefaults.RawCopy()
+		vars = newEnv.GlobalVars.RawCopy()
+		userVars = newEnv.UserVars.RawCopy()
 		err = nil
 	}
 
@@ -459,9 +460,9 @@ func (m *RpcServer) GetEnvironment(cxt context.Context, req *pb.GetEnvironmentRe
 	var defaults, vars, userVars map[string]string
 	defaults, vars, userVars, err = env.Workflow().ConsolidatedVarMaps()
 	if err != nil {
-		defaults = env.GlobalDefaults.Raw()
-		vars = env.GlobalVars.Raw()
-		userVars = env.UserVars.Raw()
+		defaults = env.GlobalDefaults.RawCopy()
+		vars = env.GlobalVars.RawCopy()
+		userVars = env.UserVars.RawCopy()
 	}
 
 	integratedServicesEnvsData := integration.PluginsInstance().GetEnvironmentsData([]uid.ID{envId})

core/serverutil.go

@@ -182,9 +182,9 @@ func workflowToRoleTree(root workflow.Role) (ri *pb.RoleInfo) {
 		FullPath:          root.GetPath(),
 		TaskIds:           tasksToTaskIds(root.GetTasks()),
 		Roles:             childRoleInfos,
-		Defaults:          root.GetDefaults().Raw(),
-		Vars:              root.GetVars().Raw(),
-		UserVars:          root.GetUserVars().Raw(),
+		Defaults:          root.GetDefaults().RawCopy(),
+		Vars:              root.GetVars().RawCopy(),
+		UserVars:          root.GetUserVars().RawCopy(),
 		ConsolidatedStack: consolidatedVarStack,
 	}
 	return

core/task/task.go

@@ -288,7 +288,7 @@ func (t *Task) BuildTaskCommand(role parentRole) (err error) {
 
 			// We make a copy of the Defaults/Vars maps from the taskClass, this is necessary because
 			// entries may be templated, so they may resolve to different values in each task.
-			localDefaults := class.Defaults.Copy().Raw()
+			localDefaults := class.Defaults.RawCopy()
 
 			// We resolve any template expressions in Defaults
 			defaultFields := template.WrapMapItems(localDefaults)
@@ -312,7 +312,7 @@ func (t *Task) BuildTaskCommand(role parentRole) (err error) {
 				return fmt.Errorf("cannot fetch task class defaults for task command info: %w", err)
 			}
 
-			localVars := class.Vars.Copy().Raw()
+			localVars := class.Vars.RawCopy()
 
 			// We resolve any template expressions in Vars
 			varFields := template.WrapMapItems(localVars)

core/task/taskclass/class.go

@@ -144,9 +144,9 @@ func (c *Class) MarshalYAML() (interface{}, error) {
 
 	aux := _class{
 		Name:        c.Identifier.Name,
-		Defaults:    c.Defaults.Raw(),
-		Vars:        c.Vars.Raw(),
-		Properties:  c.Properties.Raw(),
+		Defaults:    c.Defaults.RawCopy(),
+		Vars:        c.Vars.RawCopy(),
+		Properties:  c.Properties.RawCopy(),
 		Wants:       c.Wants,
 		Limits:      c.Limits,
 		Bind:        c.Bind,

core/workflow/rolebase.go

@@ -261,10 +261,10 @@ func (r *roleBase) MarshalYAML() (interface{}, error) {
 		aux["constraints"] = r.Constraints
 	}
 	if r.Defaults.Raw() != nil {
-		aux["defaults"] = r.Defaults.Raw()
+		aux["defaults"] = r.Defaults.RawCopy()
 	}
 	if r.Vars.Raw() != nil {
-		aux["vars"] = r.Vars.Raw()
+		aux["vars"] = r.Vars.RawCopy()
 	}
 	if r.Bind != nil {
 		aux["bind"] = r.Bind