[BUG] dangerous secret name warning list is missing BASH_ENV, ENV, ZDOTDIR, IFS and other interpreter vectors

Abierto Apto para principiantes
  • ¿Algo no está bien?
#561 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
88/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
go
Área
cli, security

Línea de trabajo

Empieza en pkg/controllers/secrets.go, en dangerousSecretNames, y luego ejecuta la reproducción documentada de doppler run con BASH_ENV, ZDOTDIR, IFS y LD_PRELOAD. Se considera terminado cuando la salida de advertencia incluye las variables de shell e intérprete enumeradas, incluidas PYTHONSTARTUP, RUBYOPT y JAVA_TOOL_OPTIONS.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug

The CLI's dangerous-secret-name warning list (dangerousSecretNames in pkg/controllers/secrets.go) is missing several well-known environment-variable code-execution vectors — most notably BASH_ENV, plus ENV, ZDOTDIR, IFS, PYTHONSTARTUP, RUBYOPT, and JAVA_TOOL_OPTIONS.

doppler run warns when the config contains dangerous secret names (per https://docs.doppler.com/docs/accessing-secrets#injection), and the docs explicitly note the list "is not exhaustive". Still, BASH_ENV is arguably the most common shell-hijack vector on Linux/macOS: non-interactive bash sources $BASH_ENV before executing a command, so a secret named BASH_ENV pointing at any shell script at a predictable path (repo scripts, CI artifact dirs, /tmp files created by the pipeline) executes in every doppler run consumer's environment. Currently it is injected with no warning, while e.g. LD_PRELOAD gets one.

Confirmed on a dev build against a mock API: with secrets BASH_ENV=/path/script, ZDOTDIR=/dir, IFS=;;, LD_PRELOAD=/lib.so:

  • the warning output listed only LD_PRELOAD
  • BASH_ENV, ZDOTDIR, and IFS were all injected into the child environment
  • the script referenced by BASH_ENV was sourced and executed by the spawned /bin/bash -c child

(Note: IFS requires no file at all — it alters word-splitting of the user's own --command.)

To Reproduce

  1. Configure secrets including BASH_ENV pointing to an existing shell script and LD_PRELOAD pointing to a nonexistent path
  2. doppler run --command '/bin/bash -c "true"' --debug
  3. Observe the warning lists only LD_PRELOAD; the BASH_ENV script executes with no warning

Expected behavior

The warning list should include the standard shell/interpreter-hijack variable names — at minimum BASH_ENV, ENV, ZDOTDIR, IFS, PYTHONSTARTUP, RUBYOPT, JAVA_TOOL_OPTIONS — so users relying on the CLI's warning get consistent coverage of the vectors the docs describe.

Suggested fix (one-line addition to dangerousSecretNames in pkg/controllers/secrets.go):

var dangerousSecretNames = [...]string{
	// Operating Systems environment variable names
	// Linux
	"PROMPT_COMMAND",
	"LD_PRELOAD",
	"LD_LIBRARY_PATH",
	"BASH_ENV", // non-interactive bash sources this
	"ENV",      // POSIX sh sources this
	"ZDOTDIR",  // zsh sources $ZDOTDIR/.zshrc
	"IFS",      // alters shell word-splitting
	...

Desktop (please complete the following information):

  • OS: Linux
  • Version 7.0.0-28-generic

CLI Version:
Built from source @ b618e5f (version dev); present in current main.

Additional context

Found during a security review of the CLI. The docs already document the RCE danger and recommend mounting as the remediation, so this is a warning-completeness improvement rather than a security report. The same review also confirmed PATH/PS1/HOME reserved-key handling works as intended. Happy to open a PR.

Lenguaje dominante
Go
Estrellas
400
Forks
87
Merge medio
38 min
PR fusionados (30 d)
2

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

  • Sin Dockerfile ni archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de DopplerHQ/cli

Todos los issues de DopplerHQ/cli

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.