search

posty / posty_chef

Chef Cookbook for a full Posty Mailserver Installation
www.posty-soft.org
Other
22 stars 8 forks source link

node attributes used in shell commands aren't properly escaped #9

Open alexanderadam opened 8 years ago

alexanderadam commented 8 years ago

See for example the dovecot recipe where you can find

command "/usr/bin/mysql -u root -p\"#{node["mysqld"]["root_password"]}\"…

which will of course result in a mess when someone uses for example double quotes in a password (node["mysqld"]["root_password"] = 'this will break >>> " <<<').