[I] cloudstack-setup-databases doesn't parse password input properly [cloudstack]

["bhorvitz (via GitHub)" <gi...@apache.org>]

bhorvitz opened a new issue, #14186:
URL: https://github.com/apache/cloudstack/issues/14186

   ### problem
   
   While running cloudstack-setup-databases, if it is called with any password containing a $, the password gets truncated at the $ before being passed to EncryptionCLI, thus storing an incorrect encrypted password in db.properties.
   
   ### versions
   
   This was discovered while executing cloudstack-setup-databases on a clean install of 4.23.
   
   ### The steps to reproduce the bug
   
   1. Call `cloudstack-setup-databases cloud:'pa$sword'@localhost --deploy-as=root:'pa$sword'`
   2. Decrypt what was stored in db.properties and note the output is only `pa`:
   ```
   # java -classpath /usr/share/cloudstack-common/lib/cloudstack-utils.jar com.cloud.utils.crypt.EncryptionCLI -d -i "4dfIlH8M/ydVp+mYjIBr7S1plQDzsOzmKt2jAeGW" -p "password"
   pa
   ```
   
   
   ### What to do about it?
   
   This seems to be a parsing issue in cloudstack-setup-databases. The password is getting to the script correctly because it is able to us it in mysql with `mysqlCmds.append('--password=\'%s\''%kwargs['passwd'])` and this part of the script succeeds.
   
   But then when it assembles the encrypt command to go to the CLI, it wraps that password in double quotes:
   `cmd = ['java','-classpath','"' + self.encryptionJarPath + '"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' + self.mgmtsecretkey + '"', self.encryptorVersion]`
   
   and then sends it through /bin/sh here (shell=True):
   `subprocess.Popen(' '.join(cmds), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)`
   
   In doing so, sh will expand the variable $sword to nothing. I haven't tested, but presumably things like `\`, `"`, and `'` might also be a problem.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] cloudstack-setup-databases doesn't parse password input properly [cloudstack]

["jdscreations (via GitHub)" <gi...@apache.org>]

jdscreations commented on issue #14186:
URL: https://github.com/apache/cloudstack/issues/14186#issuecomment-5792460449

   I'd like to take a shot at this; opened a fix here: #14229 (targeting the 4.22 branch per CONTRIBUTING.md's bug-fix guidance). Root cause and a standalone reproduction of the exact truncation are in the PR description.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] cloudstack-setup-databases doesn't parse password input properly [cloudstack]

["DaanHoogland (via GitHub)" <gi...@apache.org>]

DaanHoogland commented on issue #14186:
URL: https://github.com/apache/cloudstack/issues/14186#issuecomment-5933260000

   thanks @jdscreations , maybe using single quotes would already do the job? or escaping the '$' before passing it to the shell?
   
   Not telling you how to solve it, if it tests fine it is fine. The reason I am suggesting this is to prevent adding a dependency for which we would need to check the license.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org