fix(security): keep secrets out of the container log

CHANGELOG.md

@@ -7,6 +7,10 @@
     one in `OWNCLOUD_APPS_INSTALL` no longer aborts the container startup. A
     failing marketplace install now logs why it failed
     [#539](https://github.com/owncloud-docker/base/issues/539)
+  * `DEBUG=true` no longer prints secrets (admin, database, redis and SMTP
+    passwords, instance secret, object storage credentials, license key), and a
+    password containing a space no longer breaks `maintenance:install`
+    [#541](https://github.com/owncloud-docker/base/issues/541)
 
 * Changed
   * Removed env variable `OWNCLOUD_MARKETPLACE_KEY` (and its

v22.04/overlay/etc/entrypoint.d/10-base.sh

@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DEBUG
 [[ -z "${OWNCLOUD_DEBUG}" ]] && OWNCLOUD_DEBUG=""
 
 declare -x OWNCLOUD_SECRET
-[[ -z "${OWNCLOUD_SECRET}" ]] && OWNCLOUD_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_SECRET:+x}" ]] && OWNCLOUD_SECRET=""
 
 declare -x OWNCLOUD_CIPHER
 [[ -z "${OWNCLOUD_CIPHER}" ]] && OWNCLOUD_CIPHER=""

v22.04/overlay/etc/entrypoint.d/15-db.sh

@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DB_USERNAME
 [[ -z "${OWNCLOUD_DB_USERNAME}" ]] && OWNCLOUD_DB_USERNAME=""
 
 declare -x OWNCLOUD_DB_PASSWORD
-[[ -z "${OWNCLOUD_DB_PASSWORD}" ]] && OWNCLOUD_DB_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_DB_PASSWORD:+x}" ]] && OWNCLOUD_DB_PASSWORD=""
 
 declare -x OWNCLOUD_DB_PREFIX
 [[ -z "${OWNCLOUD_DB_PREFIX}" ]] && OWNCLOUD_DB_PREFIX="oc_"

v22.04/overlay/etc/entrypoint.d/25-redis.sh

@@ -13,7 +13,8 @@ declare -x OWNCLOUD_REDIS_DB
 [[ -z "${OWNCLOUD_REDIS_DB}" ]] && OWNCLOUD_REDIS_DB=""
 
 declare -x OWNCLOUD_REDIS_PASSWORD
-[[ -z "${OWNCLOUD_REDIS_PASSWORD}" ]] && OWNCLOUD_REDIS_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_REDIS_PASSWORD:+x}" ]] && OWNCLOUD_REDIS_PASSWORD=""
 
 declare -x OWNCLOUD_REDIS_TIMEOUT
 [[ -z "${OWNCLOUD_REDIS_TIMEOUT}" ]] && OWNCLOUD_REDIS_TIMEOUT=""

v22.04/overlay/etc/entrypoint.d/30-admin.sh

@@ -4,6 +4,7 @@ declare -x OWNCLOUD_ADMIN_USERNAME
 [[ -z "${OWNCLOUD_ADMIN_USERNAME}" ]] && OWNCLOUD_ADMIN_USERNAME="admin"
 
 declare -x OWNCLOUD_ADMIN_PASSWORD
-[[ -z "${OWNCLOUD_ADMIN_PASSWORD}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_ADMIN_PASSWORD:+x}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
 
 true

v22.04/overlay/etc/entrypoint.d/40-objectstorage.sh

@@ -16,10 +16,12 @@ declare -x OWNCLOUD_OBJECTSTORE_REGION
 [[ -z "${OWNCLOUD_OBJECTSTORE_REGION}" ]] && OWNCLOUD_OBJECTSTORE_REGION="us-east-1"
 
 declare -x OWNCLOUD_OBJECTSTORE_KEY
-[[ -z "${OWNCLOUD_OBJECTSTORE_KEY}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_KEY:+x}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
 
 declare -x OWNCLOUD_OBJECTSTORE_SECRET
-[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET:+x}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
 
 declare -x OWNCLOUD_OBJECTSTORE_ENDPOINT
 [[ -z "${OWNCLOUD_OBJECTSTORE_ENDPOINT}" ]] && OWNCLOUD_OBJECTSTORE_ENDPOINT="https://s3.${OWNCLOUD_OBJECTSTORE_REGION}.amazonaws.com"

v22.04/overlay/etc/entrypoint.d/65-license.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 
 declare -x OWNCLOUD_LICENSE_KEY
-[[ -z "${OWNCLOUD_LICENSE_KEY}" ]] && OWNCLOUD_LICENSE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_LICENSE_KEY:+x}" ]] && OWNCLOUD_LICENSE_KEY=""
 
 declare -x OWNCLOUD_LICENSE_CLASS
 [[ -z "${OWNCLOUD_LICENSE_CLASS}" ]] && OWNCLOUD_LICENSE_CLASS=""

v22.04/overlay/etc/entrypoint.d/75-mail.sh

@@ -34,6 +34,7 @@ declare -x OWNCLOUD_MAIL_SMTP_NAME
 [[ -z "${OWNCLOUD_MAIL_SMTP_NAME}" ]] && OWNCLOUD_MAIL_SMTP_NAME=""
 
 declare -x OWNCLOUD_MAIL_SMTP_PASSWORD
-[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD:+x}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
 
 true

v22.04/overlay/usr/bin/occ

@@ -9,6 +9,10 @@ if [[ -z "${OWNCLOUD_ENTRYPOINT_INITIALIZED}" ]]; then
   done
 fi
 
+# the argument list can carry credentials, e.g. "maintenance:install --admin-pass",
+# so it must not be echoed by xtrace. The caller already traces its own "occ ..." line.
+{ set +x; } 2>/dev/null
+
 if [[ "$(id -u)" == "0" ]]; then
   setpriv --reuid=www-data --regid=www-data --init-groups php /var/www/owncloud/occ "$@"
 else

v22.04/overlay/usr/bin/owncloud

@@ -11,20 +11,24 @@ fi
 
 case ${1} in
 install)
-  COMMAND="occ maintenance:install --no-interaction --data-dir ${OWNCLOUD_VOLUME_FILES}"
-  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && COMMAND="${COMMAND} --database ${OWNCLOUD_DB_TYPE}"
-  [[ -n "${OWNCLOUD_DB_NAME}" ]] && COMMAND="${COMMAND} --database-name ${OWNCLOUD_DB_NAME}"
-  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && COMMAND="${COMMAND} --database-user ${OWNCLOUD_DB_USERNAME}"
-  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && COMMAND="${COMMAND} --database-pass ${OWNCLOUD_DB_PASSWORD}"
-  [[ -n "${OWNCLOUD_DB_HOST}" ]] && COMMAND="${COMMAND} --database-host ${OWNCLOUD_DB_HOST}"
-  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && COMMAND="${COMMAND} --database-table-prefix ${OWNCLOUD_DB_PREFIX}"
-  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && COMMAND="${COMMAND} --admin-user ${OWNCLOUD_ADMIN_USERNAME}"
-  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && COMMAND="${COMMAND} --admin-pass ${OWNCLOUD_ADMIN_PASSWORD}"
+  ARGS=(maintenance:install --no-interaction --data-dir "${OWNCLOUD_VOLUME_FILES}")
+  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && ARGS+=(--database "${OWNCLOUD_DB_TYPE}")
+  [[ -n "${OWNCLOUD_DB_NAME}" ]] && ARGS+=(--database-name "${OWNCLOUD_DB_NAME}")
+  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && ARGS+=(--database-user "${OWNCLOUD_DB_USERNAME}")
+  [[ -n "${OWNCLOUD_DB_HOST}" ]] && ARGS+=(--database-host "${OWNCLOUD_DB_HOST}")
+  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && ARGS+=(--database-table-prefix "${OWNCLOUD_DB_PREFIX}")
+  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && ARGS+=(--admin-user "${OWNCLOUD_ADMIN_USERNAME}")
+
+  # keep the credentials out of the xtrace output when DEBUG=true
+  { set +x; } 2>/dev/null
+  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && ARGS+=(--database-pass "${OWNCLOUD_DB_PASSWORD}")
+  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && ARGS+=(--admin-pass "${OWNCLOUD_ADMIN_PASSWORD}")
 
   set +e
-  ${COMMAND}
+  occ "${ARGS[@]}"
   RES=$?
   set -e
+  [[ "${DEBUG}" == "true" ]] && set -x
 
   if [[ "${RES}" -ge "1" ]]; then
     exit ${RES}

v24.04/overlay/etc/entrypoint.d/10-base.sh

@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DEBUG
 [[ -z "${OWNCLOUD_DEBUG}" ]] && OWNCLOUD_DEBUG=""
 
 declare -x OWNCLOUD_SECRET
-[[ -z "${OWNCLOUD_SECRET}" ]] && OWNCLOUD_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_SECRET:+x}" ]] && OWNCLOUD_SECRET=""
 
 declare -x OWNCLOUD_CIPHER
 [[ -z "${OWNCLOUD_CIPHER}" ]] && OWNCLOUD_CIPHER=""

v24.04/overlay/etc/entrypoint.d/15-db.sh

@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DB_USERNAME
 [[ -z "${OWNCLOUD_DB_USERNAME}" ]] && OWNCLOUD_DB_USERNAME=""
 
 declare -x OWNCLOUD_DB_PASSWORD
-[[ -z "${OWNCLOUD_DB_PASSWORD}" ]] && OWNCLOUD_DB_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_DB_PASSWORD:+x}" ]] && OWNCLOUD_DB_PASSWORD=""
 
 declare -x OWNCLOUD_DB_PREFIX
 [[ -z "${OWNCLOUD_DB_PREFIX}" ]] && OWNCLOUD_DB_PREFIX="oc_"

v24.04/overlay/etc/entrypoint.d/25-redis.sh

@@ -13,7 +13,8 @@ declare -x OWNCLOUD_REDIS_DB
 [[ -z "${OWNCLOUD_REDIS_DB}" ]] && OWNCLOUD_REDIS_DB=""
 
 declare -x OWNCLOUD_REDIS_PASSWORD
-[[ -z "${OWNCLOUD_REDIS_PASSWORD}" ]] && OWNCLOUD_REDIS_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_REDIS_PASSWORD:+x}" ]] && OWNCLOUD_REDIS_PASSWORD=""
 
 declare -x OWNCLOUD_REDIS_TIMEOUT
 [[ -z "${OWNCLOUD_REDIS_TIMEOUT}" ]] && OWNCLOUD_REDIS_TIMEOUT=""

v24.04/overlay/etc/entrypoint.d/30-admin.sh

@@ -4,6 +4,7 @@ declare -x OWNCLOUD_ADMIN_USERNAME
 [[ -z "${OWNCLOUD_ADMIN_USERNAME}" ]] && OWNCLOUD_ADMIN_USERNAME="admin"
 
 declare -x OWNCLOUD_ADMIN_PASSWORD
-[[ -z "${OWNCLOUD_ADMIN_PASSWORD}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_ADMIN_PASSWORD:+x}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
 
 true

v24.04/overlay/etc/entrypoint.d/40-objectstorage.sh

@@ -16,10 +16,12 @@ declare -x OWNCLOUD_OBJECTSTORE_REGION
 [[ -z "${OWNCLOUD_OBJECTSTORE_REGION}" ]] && OWNCLOUD_OBJECTSTORE_REGION="us-east-1"
 
 declare -x OWNCLOUD_OBJECTSTORE_KEY
-[[ -z "${OWNCLOUD_OBJECTSTORE_KEY}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_KEY:+x}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
 
 declare -x OWNCLOUD_OBJECTSTORE_SECRET
-[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET:+x}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
 
 declare -x OWNCLOUD_OBJECTSTORE_ENDPOINT
 [[ -z "${OWNCLOUD_OBJECTSTORE_ENDPOINT}" ]] && OWNCLOUD_OBJECTSTORE_ENDPOINT="https://s3.${OWNCLOUD_OBJECTSTORE_REGION}.amazonaws.com"

v24.04/overlay/etc/entrypoint.d/65-license.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 
 declare -x OWNCLOUD_LICENSE_KEY
-[[ -z "${OWNCLOUD_LICENSE_KEY}" ]] && OWNCLOUD_LICENSE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_LICENSE_KEY:+x}" ]] && OWNCLOUD_LICENSE_KEY=""
 
 declare -x OWNCLOUD_LICENSE_CLASS
 [[ -z "${OWNCLOUD_LICENSE_CLASS}" ]] && OWNCLOUD_LICENSE_CLASS=""

v24.04/overlay/etc/entrypoint.d/75-mail.sh

@@ -34,6 +34,7 @@ declare -x OWNCLOUD_MAIL_SMTP_NAME
 [[ -z "${OWNCLOUD_MAIL_SMTP_NAME}" ]] && OWNCLOUD_MAIL_SMTP_NAME=""
 
 declare -x OWNCLOUD_MAIL_SMTP_PASSWORD
-[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD:+x}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
 
 true

v24.04/overlay/usr/bin/occ

@@ -9,6 +9,10 @@ if [[ -z "${OWNCLOUD_ENTRYPOINT_INITIALIZED}" ]]; then
   done
 fi
 
+# the argument list can carry credentials, e.g. "maintenance:install --admin-pass",
+# so it must not be echoed by xtrace. The caller already traces its own "occ ..." line.
+{ set +x; } 2>/dev/null
+
 if [[ "$(id -u)" == "0" ]]; then
   setpriv --reuid=www-data --regid=www-data --init-groups php /var/www/owncloud/occ "$@"
 else

v24.04/overlay/usr/bin/owncloud

@@ -11,20 +11,24 @@ fi
 
 case ${1} in
 install)
-  COMMAND="occ maintenance:install --no-interaction --data-dir ${OWNCLOUD_VOLUME_FILES}"
-  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && COMMAND="${COMMAND} --database ${OWNCLOUD_DB_TYPE}"
-  [[ -n "${OWNCLOUD_DB_NAME}" ]] && COMMAND="${COMMAND} --database-name ${OWNCLOUD_DB_NAME}"
-  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && COMMAND="${COMMAND} --database-user ${OWNCLOUD_DB_USERNAME}"
-  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && COMMAND="${COMMAND} --database-pass ${OWNCLOUD_DB_PASSWORD}"
-  [[ -n "${OWNCLOUD_DB_HOST}" ]] && COMMAND="${COMMAND} --database-host ${OWNCLOUD_DB_HOST}"
-  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && COMMAND="${COMMAND} --database-table-prefix ${OWNCLOUD_DB_PREFIX}"
-  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && COMMAND="${COMMAND} --admin-user ${OWNCLOUD_ADMIN_USERNAME}"
-  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && COMMAND="${COMMAND} --admin-pass ${OWNCLOUD_ADMIN_PASSWORD}"
+  ARGS=(maintenance:install --no-interaction --data-dir "${OWNCLOUD_VOLUME_FILES}")
+  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && ARGS+=(--database "${OWNCLOUD_DB_TYPE}")
+  [[ -n "${OWNCLOUD_DB_NAME}" ]] && ARGS+=(--database-name "${OWNCLOUD_DB_NAME}")
+  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && ARGS+=(--database-user "${OWNCLOUD_DB_USERNAME}")
+  [[ -n "${OWNCLOUD_DB_HOST}" ]] && ARGS+=(--database-host "${OWNCLOUD_DB_HOST}")
+  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && ARGS+=(--database-table-prefix "${OWNCLOUD_DB_PREFIX}")
+  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && ARGS+=(--admin-user "${OWNCLOUD_ADMIN_USERNAME}")
+
+  # keep the credentials out of the xtrace output when DEBUG=true
+  { set +x; } 2>/dev/null
+  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && ARGS+=(--database-pass "${OWNCLOUD_DB_PASSWORD}")
+  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && ARGS+=(--admin-pass "${OWNCLOUD_ADMIN_PASSWORD}")
 
   set +e
-  ${COMMAND}
+  occ "${ARGS[@]}"
   RES=$?
   set -e
+  [[ "${DEBUG}" == "true" ]] && set -x
 
   if [[ "${RES}" -ge "1" ]]; then
     exit ${RES}