imbajin commented on code in PR #3189:
URL: https://github.com/apache/hugegraph/pull/3189#discussion_r3928071839
##########
hugegraph-pd/hg-pd-dist/docker/docker-entrypoint.sh:
##########
@@ -57,8 +57,16 @@ require_env "HG_PD_INITIAL_STORE_LIST"
: "${HG_PD_DATA_PATH:=/hugegraph-pd/pd_data}"
: "${HG_PD_INITIAL_STORE_COUNT:=1}"
+# Optional secret for REST Basic authentication (auth.secret-key). When unset,
+# the value from conf/application.yml applies. Never logged.
+AUTH_JSON=""
+if [[ -n "${HG_PD_AUTH_SECRET_KEY:-}" ]]; then
+ AUTH_JSON="\"auth\": { \"secret-key\": \"$(json_escape
"${HG_PD_AUTH_SECRET_KEY}")\" },"
Review Comment:
⚠️ The optional secret is inserted through `json_escape`, but that helper
only escapes backslashes and quotes and removes LF; it leaves other JSON
control characters such as CR and tab unescaped. Reproduction: on this exact
head, setting HG_PD_AUTH_SECRET_KEY to a value containing `a\rb` produces an
invalid SPRING_APPLICATION_JSON, so the PD container fails before startup.
Please escape all JSON control characters or avoid hand-building this JSON, and
add a test for the override.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
