cloudstack-setup-databases doesn't parse password input properly
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Domain
- databases, infrastructure
Research direction
Start at the cloudstack-setup-databases entry point and trace how the password is assembled for EncryptionCLI and passed through /bin/sh. Reproduce with the provided password containing $, then verify that the decrypted value remains intact and that other special characters mentioned in the issue are handled correctly.
Written by the indexing model from the issue text.
Description
problem
While running cloudstack-setup-databases, if it is called with any password containing a $, the password gets truncated at the $ before being passed to EncryptionCLI, thus storing an incorrect encrypted password in db.properties.
versions
This was discovered while executing cloudstack-setup-databases on a clean install of 4.23.
The steps to reproduce the bug
- Call
cloudstack-setup-databases cloud:'pa$sword'@localhost --deploy-as=root:'pa$sword' - Decrypt what was stored in db.properties and note the output is only
pa:
# java -classpath /usr/share/cloudstack-common/lib/cloudstack-utils.jar com.cloud.utils.crypt.EncryptionCLI -d -i "4dfIlH8M/ydVp+mYjIBr7S1plQDzsOzmKt2jAeGW" -p "password"
pa
What to do about it?
This seems to be a parsing issue in cloudstack-setup-databases. The password is getting to the script correctly because it is able to us it in mysql with mysqlCmds.append('--password=\'%s\''%kwargs['passwd']) and this part of the script succeeds.
But then when it assembles the encrypt command to go to the CLI, it wraps that password in double quotes:
cmd = ['java','-classpath','"' + self.encryptionJarPath + '"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' + self.mgmtsecretkey + '"', self.encryptorVersion]
and then sends it through /bin/sh here (shell=True):
subprocess.Popen(' '.join(cmds), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
In doing so, sh will expand the variable $sword to nothing. I haven't tested, but presumably things like \, ", and ' might also be a problem.
- Dominant language
- Java
- Stars
- 3.1k
- Forks
- 1.4k
- Avg merge
- 6d 20h
- Merged PRs (30d)
- 27
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/cloudstack
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/cloudstack#14222 ·
-
bug component:kubernetes
Difficulty 1/5 Under an hour Newbie friendliness 88/100
apache/cloudstack#14180 ·
-
bug component:projects component:UI
Difficulty 1/5 Under an hour Newbie friendliness 88/100
apache/cloudstack#14070 · 5 comments ·
-
component:backup
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/cloudstack#14013 ·
-
KVM agent fails to connect to Ceph RBD storage pool after upgrading Ceph client to Tentacle 20.2.4 Openbug component:ceph
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/cloudstack#13989 · 3 comments ·
All issues in apache/cloudstack
Similar issues
-
area/plugin
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
kestra-io/plugin-kestra#190 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
google-ai-edge/LiteRT-LM#3739 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
integra-team-red/meet-map#249 ·
-
[Studio][Bug] Cancelled create-user dialog keeps the password and admin switch for the next attempt Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
apache/rocketmq-dashboard#5064 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
wso2/dpdp-accelerator#287 ·