Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

cloudstack-setup-databases doesn't parse password input properly

Aberta
  • Algo errado?
#14,186 2 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@jdscreations já está trabalhando nisso.

Desde 23/9/2026.

  • #14229 de @jdscreations — aberto

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
72/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
java, python, shell
Domínio
databases, infrastructure

Direção de pesquisa

Start at the cloudstack-setup-databases entry point and trace how the password is assembled for EncryptionCLI and passed through /bin/sh. Reproduce with the provided password containing $, then verify that the decrypted value remains intact and that other special characters mentioned in the issue are handled correctly.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

bug
problem

While running cloudstack-setup-databases, if it is called with any password containing a $, the password gets truncated at the $ before being passed to EncryptionCLI, thus storing an incorrect encrypted password in db.properties.

versions

This was discovered while executing cloudstack-setup-databases on a clean install of 4.23.

The steps to reproduce the bug
  1. Call cloudstack-setup-databases cloud:'pa$sword'@localhost --deploy-as=root:'pa$sword'
  2. Decrypt what was stored in db.properties and note the output is only pa:
# java -classpath /usr/share/cloudstack-common/lib/cloudstack-utils.jar com.cloud.utils.crypt.EncryptionCLI -d -i "4dfIlH8M/ydVp+mYjIBr7S1plQDzsOzmKt2jAeGW" -p "password"
pa
What to do about it?

This seems to be a parsing issue in cloudstack-setup-databases. The password is getting to the script correctly because it is able to us it in mysql with mysqlCmds.append('--password=\'%s\''%kwargs['passwd']) and this part of the script succeeds.

But then when it assembles the encrypt command to go to the CLI, it wraps that password in double quotes:
cmd = ['java','-classpath','"' + self.encryptionJarPath + '"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' + self.mgmtsecretkey + '"', self.encryptorVersion]

and then sends it through /bin/sh here (shell=True):
subprocess.Popen(' '.join(cmds), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

In doing so, sh will expand the variable $sword to nothing. I haven't tested, but presumably things like \, ", and ' might also be a problem.

Linguagem predominante
Java
Estrelas
3.1k
Forks
1.4k
Merge médio
6d 3h
PRs com merge (30d)
16

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de apache/cloudstack

Todas as issues de apache/cloudstack

Issues semelhantes

Mais issues de Java

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.