linuxserver / docker-bookstack

A Docker container for the BookStack documentation wiki
GNU General Public License v3.0
797 stars 109 forks source link

Escape special characters in DB_PASS environment variable when substituting with sed #101

Closed Kangie closed 3 years ago

Kangie commented 3 years ago

linuxserver.io



Description:

Escape special characters in DB_PASSWORD environment variable before they're used in a sed substitution.

Benefits of this PR and context:

A DB_PASS variable containing any of the following characters will not be output verbatim in a sed replacement string:

Causing Bookstack initialisations to fail as the DB and Web App are provided with different passwords.

How Has This Been Tested?

Tested in Bash/Zsh:

Old Behaviour:

matt@matt-pc ~/ $ echo 'DB_PASSWORD=database_user_password' > regex_test.env
matt@matt-pc ~/ $ cat regex_test.env 
DB_PASSWORD=database_user_password
matt@matt-pc ~/ $ sed -i "s/DB_PASSWORD=database_user_password/DB_PASSWORD=${DB_PASS}/g" regex_test.env
matt@matt-pc ~/ $ cat regex_test.env 
DB_PASSWORD=!UX$vzT!2!w6r3sEb2XXFWDB_PASSWORD=database_user_passwordY2byHc

New Behaviour:

matt@laptop ~/ $ DB_PASS='!UX$vzT!2!w6r3sEb2XXFW&Y2byHc'
matt@laptop ~/ $ ESCAPED_PASSWORD=$(sed -e 's/[$\/&]/\\&/g' <<< $DB_PASS)
matt@laptop ~/ $ echo $ESCAPED_PASSWORD                   
!UX\$vzT!2!w6r3sEb2XXFW\&Y2byHc
matt@laptop ~/ $ echo 'DB_PASSWORD=database_user_password' > regex_test.env 
matt@laptop ~/ $ cat regex_test.env                  
DB_PASSWORD=database_user_password
matt@laptop ~/ $ sed -i "s/DB_PASSWORD=database_user_password/DB_PASSWORD=${ESCAPED_PASSWORD}/g" regex_test.env 
matt@laptop ~/ $ cat regex_test.env 
DB_PASSWORD=!UX$vzT!2!w6r3sEb2XXFW&Y2byHc

Source / References:

Fixes #100

LinuxServer-CI commented 3 years ago

I am a bot, here are the test results for this PR: https://ci-tests.linuxserver.io/lspipepr/bookstack/v21.05.2-pkg-af5df187-pr-101/index.html https://ci-tests.linuxserver.io/lspipepr/bookstack/v21.05.2-pkg-af5df187-pr-101/shellcheck-result.xml