Skip to content

Potential fix for code scanning alert no. 1: Clear-text storage of sensitive information #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
karlspace wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Potential fix for code scanning alert no. 1: Clear-text storage of sensitive information #15

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 10 additions & 11 deletions scripts/generate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@
def write(path: Path, content: str, *, executable: bool = False) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
# LF line endings regardless of host OS - these files run on Linux.
path.write_bytes(content.encode("utf-8"))

Check failure

Code scanning / CodeQL

Clear-text storage of sensitive information High

This expression stores
sensitive data (password)
Loading
as clear text.
This expression stores sensitive data (password) as clear text.
This expression stores
sensitive data (password)
Loading
as clear text.
This expression stores sensitive data (password) as clear text.
if executable:
path.chmod(path.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)

Expand Down Expand Up @@ -452,12 +452,17 @@

for user in users:
name = user["name"]
pw = user["password"]
pw_hash = user["password"]
if not re.match(r"^\$[0-9a-zA-Z]+\$", str(pw_hash)):
fail(
f"user '{name}' password must be a pre-hashed crypt value (for example '$6$...'); "
"refusing to store plaintext passwords in generated artifacts."
)
shell = user.get("shell", "/bin/bash")
groups = ",".join(user.get("groups", []))
script.append(f"# === user: {name} ===")
script.append(f"if ! id -u {shlex.quote(name)} >/dev/null 2>&1; then")
script.append(f" useradd -m -s {shlex.quote(shell)} {shlex.quote(name)}")
script.append(f" useradd -m -s {shlex.quote(shell)} {shlex.quote(name)}")
script.append("fi")
if groups:
# `usermod -aG` fails hard on any non-existent group. Pre-create
Expand All @@ -469,15 +474,9 @@
f"getent group {shlex.quote(g)} >/dev/null || groupadd {shlex.quote(g)}"
)
script.append(f"usermod -aG {shlex.quote(groups)} {shlex.quote(name)}")
# chpasswd via stdin keeps the password out of argv / process lists.
script.append(f"echo {shlex.quote(f'{name}:{pw}')} | chpasswd")
if pw in _KNOWN_DEMO_PASSWORDS:
# These are PUBLIC images, so the default credential stays
# documented and discoverable - that is what keeps onboarding
# fast. Expiring it only means the operator is prompted to set a
# new password at the first login they were going to do anyway;
# login(1) on the console and sshd (UsePAM yes) both enforce it.
script.append(f"chage -d 0 {shlex.quote(name)}")
# chpasswd via stdin keeps credentials out of argv/process lists.
# Use -e so config provides a pre-hashed password, never plaintext.
script.append(f"echo {shlex.quote(f'{name}:{pw_hash}')} | chpasswd -e")
if user.get("sudo_nopasswd"):
sudoers_line = f"{name} ALL=(ALL) NOPASSWD:ALL"
script.append(
Expand Down
Loading