golemfactory / dapp-manager

GNU Lesser General Public License v2.1
5 stars 4 forks source link

Dapp-Manager exposes a SQL-dump when reading data #100

Closed cryptobench closed 1 year ago

cryptobench commented 1 year ago

Hello.

I just noticed that in one of our backend's response some SQL data dump was exposed by the Dapp-Manager

This is our functions that's used on the portal.

export default function CliAdapter(dManagerCmd: ICmdRunner, dStatsCmd: ICmdRunner): ICliAdapter {
  async function getDetails(command: string, appId: string, ensureAlive = true) {
    const result = await dManagerCmd.run("read", appId, command, ensureAlive ? "" : "--no-ensure-alive");
    return result.stdout.trim();
  }

Here's some of the data that was in the response

image

shadeofblue commented 1 year ago

this is not an issue with the dapp-manager or dapp-runner ... it's the app's responsibility not to expose any vulnerable data in its stdout/stderr strings