bhorvitz opened a new issue, #14186:
URL: https://github.com/apache/cloudstack/issues/14186
### problem
While running cloudstack-setup-databases, if it is called with any password
containing a $, the password gets truncated at the $ before being passed to
EncryptionCLI, thus storing an incorrect encrypted password in db.properties.
### versions
This was discovered while executing cloudstack-setup-databases on a clean
install of 4.23.
### The steps to reproduce the bug
1. Call `cloudstack-setup-databases cloud:'pa$sword'@localhost
--deploy-as=root:'pa$sword'`
2. Decrypt what was stored in db.properties and note the output is only `pa`:
```
# java -classpath /usr/share/cloudstack-common/lib/cloudstack-utils.jar
com.cloud.utils.crypt.EncryptionCLI -d -i
"4dfIlH8M/ydVp+mYjIBr7S1plQDzsOzmKt2jAeGW" -p "password"
pa
```
### What to do about it?
This seems to be a parsing issue in cloudstack-setup-databases. The password
is getting to the script correctly because it is able to us it in mysql with
`mysqlCmds.append('--password=\'%s\''%kwargs['passwd'])` and this part of the
script succeeds.
But then when it assembles the encrypt command to go to the CLI, it wraps
that password in double quotes:
`cmd = ['java','-classpath','"' + self.encryptionJarPath +
'"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' +
self.mgmtsecretkey + '"', self.encryptorVersion]`
and then sends it through /bin/sh here (shell=True):
`subprocess.Popen(' '.join(cmds), shell=True, stdout=subprocess.PIPE,
stderr=subprocess.PIPE)`
In doing so, sh will expand the variable $sword to nothing. I haven't
tested, but presumably things like `\`, `"`, and `'` might also be a problem.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
