cloudstack-setup-databases doesn't parse password input properly

Aperta
#14,186 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
java, python, shell
Ambito
databases, infrastructure

Direzione di ricerca

Start at the cloudstack-setup-databases entry point and trace how the password is assembled for EncryptionCLI and passed through /bin/sh. Reproduce with the provided password containing $, then verify that the decrypted value remains intact and that other special characters mentioned in the issue are handled correctly.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
problem

While running cloudstack-setup-databases, if it is called with any password containing a $, the password gets truncated at the $ before being passed to EncryptionCLI, thus storing an incorrect encrypted password in db.properties.

versions

This was discovered while executing cloudstack-setup-databases on a clean install of 4.23.

The steps to reproduce the bug
  1. Call cloudstack-setup-databases cloud:'pa$sword'@localhost --deploy-as=root:'pa$sword'
  2. Decrypt what was stored in db.properties and note the output is only pa:
# java -classpath /usr/share/cloudstack-common/lib/cloudstack-utils.jar com.cloud.utils.crypt.EncryptionCLI -d -i "4dfIlH8M/ydVp+mYjIBr7S1plQDzsOzmKt2jAeGW" -p "password"
pa
What to do about it?

This seems to be a parsing issue in cloudstack-setup-databases. The password is getting to the script correctly because it is able to us it in mysql with mysqlCmds.append('--password=\'%s\''%kwargs['passwd']) and this part of the script succeeds.

But then when it assembles the encrypt command to go to the CLI, it wraps that password in double quotes:
cmd = ['java','-classpath','"' + self.encryptionJarPath + '"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' + self.mgmtsecretkey + '"', self.encryptorVersion]

and then sends it through /bin/sh here (shell=True):
subprocess.Popen(' '.join(cmds), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

In doing so, sh will expand the variable $sword to nothing. I haven't tested, but presumably things like \, ", and ' might also be a problem.

Lingua principale
Java
Stelle
3.1k
Fork
1.4k
Merge medio
7g 5h
PR unite (30g)
28

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/cloudstack

Tutte le issue di apache/cloudstack

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.