imbajin commented on code in PR #3189:
URL: https://github.com/apache/hugegraph/pull/3189#discussion_r3967605763
##########
hugegraph-pd/hg-pd-dist/docker/docker-entrypoint.sh:
##########
@@ -51,14 +81,44 @@ require_env "HG_PD_GRPC_HOST"
require_env "HG_PD_RAFT_ADDRESS"
require_env "HG_PD_RAFT_PEERS_LIST"
require_env "HG_PD_INITIAL_STORE_LIST"
+# The REST API refuses every authenticated request without this, and the image
+# ships no default because a published secret is not a secret.
+require_env "HG_PD_AUTH_SECRET_KEY"
: "${HG_PD_GRPC_PORT:=8686}"
: "${HG_PD_REST_PORT:=8620}"
: "${HG_PD_DATA_PATH:=/hugegraph-pd/pd_data}"
: "${HG_PD_INITIAL_STORE_COUNT:=1}"
+# Actuator endpoints reachable without a credential. Hardened by default; an
+# operator who needs /actuator/info or /actuator/loggers from this image opts
+# in deliberately instead of losing the endpoint. "*" is refused: /actuator/env
+# returns the SPRING_APPLICATION_JSON entry below verbatim, secret included.
+: "${HG_PD_ACTUATOR_EXPOSURE:=health,metrics,prometheus}"
Review Comment:
⚠️ `env` remains an accepted actuator exposure even though this entrypoint
embeds `auth.secret-key` in `SPRING_APPLICATION_JSON`. The guard below rejects
only values containing `*`; with `HG_PD_ACTUATOR_EXPOSURE=env`, `/actuator/env`
is exposed anonymously and the environment entry can return the PD secret
verbatim, as the comment at lines 107-110 documents. Please reject `env` (and
other raw environment exposure) or move the secret out of
`SPRING_APPLICATION_JSON`, and add a regression case alongside the wildcard
tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
