Skip to content

simplerisk-minimal: harden config.php substitution against / in values #137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WolfangAukang merged 2 commits into from
May 20, 2026
Merged

simplerisk-minimal: harden config.php substitution against / in values #137

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f143f4
simplerisk-minimal: harden config.php substitution against / in values
jsokol May 20, 2026
a373e5b
Merge branch 'master' into fix-config-sed-escaping
WolfangAukang May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 29 additions & 10 deletions simplerisk-minimal/common/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,14 @@ generate_random_password() {
echo "$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c21)"
}

# Escape a value for use as the replacement in a sed s|...|VALUE|... command.
# Escapes \, &, and | so they aren't interpreted as sed metacharacters.
# Required for any env-var-derived value that may contain / (which would
# otherwise terminate the / delimiter the sed substitution used to use).
sed_escape() {
printf '%s' "$1" | sed -e 's/[\\&|]/\\&/g'
}

fatal_error(){
print_log "error" "$1"
exit 1
Expand All @@ -31,7 +39,7 @@ set_db_password(){
else
SIMPLERISK_DB_PASSWORD=${SIMPLERISK_DB_PASSWORD:-simplerisk}
fi
exec_cmd "sed -i \"s/\('DB_PASSWORD', '\).*\(');\)/\1$SIMPLERISK_DB_PASSWORD\2/g\" $CONFIG_PATH"
sed -i "s|\('DB_PASSWORD', '\).*\(');\)|\1$(sed_escape "$SIMPLERISK_DB_PASSWORD")\2|g" "$CONFIG_PATH"
}

validate_db_setup(){
Expand Down Expand Up @@ -67,22 +75,33 @@ set_config(){
print_log "initial_setup:info" "$CONFIG_SAMPLE_PATH not found; reusing existing $CONFIG_PATH (likely upgrading from an older image on a persisted volume)."
fi

# Replacing config variables if they exist
SIMPLERISK_DB_HOSTNAME=${SIMPLERISK_DB_HOSTNAME:-localhost} && exec_cmd "sed -i \"s/\('DB_HOSTNAME', '\).*\(');\)/\1$SIMPLERISK_DB_HOSTNAME\2/g\" $CONFIG_PATH"
# Replacing config variables. Values are run through sed_escape so paths
# or other inputs containing \, &, or | don't break the substitution.
SIMPLERISK_DB_HOSTNAME=${SIMPLERISK_DB_HOSTNAME:-localhost}
sed -i "s|\('DB_HOSTNAME', '\).*\(');\)|\1$(sed_escape "$SIMPLERISK_DB_HOSTNAME")\2|g" "$CONFIG_PATH"

SIMPLERISK_DB_PORT=${SIMPLERISK_DB_PORT:-3306} && exec_cmd "sed -i \"s/\('DB_PORT', '\).*\(');\)/\1$SIMPLERISK_DB_PORT\2/g\" $CONFIG_PATH"
SIMPLERISK_DB_PORT=${SIMPLERISK_DB_PORT:-3306}
sed -i "s|\('DB_PORT', '\).*\(');\)|\1$(sed_escape "$SIMPLERISK_DB_PORT")\2|g" "$CONFIG_PATH"

SIMPLERISK_DB_USERNAME=${SIMPLERISK_DB_USERNAME:-simplerisk} && exec_cmd "sed -i \"s/\('DB_USERNAME', '\).*\(');\)/\1$SIMPLERISK_DB_USERNAME\2/g\" $CONFIG_PATH"
SIMPLERISK_DB_USERNAME=${SIMPLERISK_DB_USERNAME:-simplerisk}
sed -i "s|\('DB_USERNAME', '\).*\(');\)|\1$(sed_escape "$SIMPLERISK_DB_USERNAME")\2|g" "$CONFIG_PATH"

set_db_password

SIMPLERISK_DB_DATABASE=${SIMPLERISK_DB_DATABASE:-simplerisk} && exec_cmd "sed -i \"s/\('DB_DATABASE', '\).*\(');\)/\1$SIMPLERISK_DB_DATABASE\2/g\" $CONFIG_PATH"
SIMPLERISK_DB_DATABASE=${SIMPLERISK_DB_DATABASE:-simplerisk}
sed -i "s|\('DB_DATABASE', '\).*\(');\)|\1$(sed_escape "$SIMPLERISK_DB_DATABASE")\2|g" "$CONFIG_PATH"

# shellcheck disable=SC2015
[ -n "${SIMPLERISK_DB_FOR_SESSIONS:-}" ] && sed -i "s/\('USE_DATABASE_FOR_SESSIONS', '\).*\(');\)/\1$SIMPLERISK_DB_FOR_SESSIONS\2/g" $CONFIG_PATH || true
SIMPLERISK_DB_FOR_SESSIONS=${SIMPLERISK_DB_FOR_SESSIONS:-true}
sed -i "s|\('USE_DATABASE_FOR_SESSIONS', '\).*\(');\)|\1$(sed_escape "$SIMPLERISK_DB_FOR_SESSIONS")\2|g" "$CONFIG_PATH"

# shellcheck disable=SC2015
[ -n "${SIMPLERISK_DB_SSL_CERT_PATH:-}" ] && sed -i "s/\('DB_SSL_CERTIFICATE_PATH', '\).*\(');\)/\1$SIMPLERISK_DB_SSL_CERT_PATH\2/g" $CONFIG_PATH || true
if [ -n "${SIMPLERISK_DB_SSL_CERT_PATH:-}" ]; then
# The sample ships DB_SSL_CERTIFICATE_PATH as a commented-out line so
# that operators who don't set the env var don't end up requesting SSL
# against a non-existent cert path. When a path is supplied, rewrite
# the whole line (commented or not) as an active define.
escaped_ssl_path=$(sed_escape "$SIMPLERISK_DB_SSL_CERT_PATH")
sed -i "s|^[[:space:]]*\(//[[:space:]]*\)\{0,1\}define('DB_SSL_CERTIFICATE_PATH', '[^']*');|define('DB_SSL_CERTIFICATE_PATH', '${escaped_ssl_path}');|" "$CONFIG_PATH"
fi
}

set_csrf_secret(){
Expand Down