Closed bdunne closed 6 months ago
This feels like it's bandaiding the underlying problem. Why is Ruby seeing it as an integer in the first place? I would have expected it to see a String. Makes me think we are not encoding into yaml somewhere properly (and that gets me worried about passwords starting with !
for example)
This feels like it's bandaiding the underlying problem. Why is Ruby seeing it as an integer in the first place? I would have expected it to see a String. Makes me think we are not encoding into yaml somewhere properly (and that gets me worried about passwords starting with
!
for example)
The password is passed into the container via ENV or file mount here then written into database.yml. So, in this case we saw:
---
production:
adapter: postgresql
username: root
password: 8783875645714351
...
And when it was YAML loaded, password became an integer.
Right, so that tells me we aren't writing the YAML correctly. The correct YAML should have been:
---
production:
adapter: postgresql
username: root
password: "8783875645714351"
My concern is that there are other password characters that can cause similar issues, such as a leading !
, "
, or |
character. I realize we use hex now, so that can't happen in this case, but I also don't think we should be using hex moving forward, but instead something like base64 with a wider character set.
Backported to quinteros
in commit 743ce2ce751d476b3cdf3374749df21db3069312.
commit 743ce2ce751d476b3cdf3374749df21db3069312
Author: Jason Frey <fryguy9@gmail.com>
Date: Thu Feb 8 10:35:25 2024 -0500
Merge pull request #1052 from bdunne/database_password_integer
Only return passwords that include letters.
(cherry picked from commit 668e69924bd86df71c135251af091fe87c8d84ca)
Password decryption can fail if the database password is all numbers because ruby will read it as an integer instead of a string.