Skip to content

Load secrets from _FILE environment variables #2019

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
itsalljustdata wants to merge 1 commit into from
+12 −0
Closed

Load secrets from _FILE environment variables #2019

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions packaging/docker/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,16 @@ fi
mkdir -p /app/data /bookdrop /books
chown "$USER_ID:$GROUP_ID" /app/data /bookdrop /books 2>/dev/null || true

# Process _FILE environment variables for secrets
for var in $(env | grep '_FILE=' | cut -d= -f1); do
file_path=$(eval echo \$$var)
Comment on lines +38 to +39

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Remove eval from environment-variable lookup.

eval echo \$$var reparses the environment-derived name as shell code. A crafted environment variable name can therefore execute arbitrary commands before su-exec drops privileges. Use a safe lookup such as printenv "$var" and validate the variable name before exporting it.

🧰 Tools
🪛 ast-grep (0.44.1)

[error] 38-38: eval is invoked on a variable, parameter expansion, or command-substitution result, which re-parses the value as shell code. If any part of that value is attacker-controlled (arguments, environment, file contents, network output), it allows arbitrary command execution. Do not eval dynamic data: invoke the command directly with proper quoting (e.g. "$cmd" "$arg"), use arrays for argument lists (cmd=(prog --flag "$value"); "${cmd[@]}"), or restrict input to a validated allowlist before running it.
Context: eval echo $$var
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(eval-on-variable-bash)

🪛 Shellcheck (0.11.0)

[info] 39-39: Double quote to prevent globbing and word splitting.

(SC2086)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packaging/docker/entrypoint.sh` around lines 38 - 39, Replace the eval-based
lookup in the environment-variable loop with a safe lookup using the variable
name as data, such as printenv "$var". Validate that each var matches the
expected environment-variable naming pattern before using it, then preserve the
existing export behavior without evaluating environment-derived shell code.

Source: Linters/SAST tools

if [ -n "$file_path" ] && [ -f "$file_path" ]; then
var_name=${var%_FILE}
export "$var_name"=$(cat "$file_path")
Comment on lines +38 to +42

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Restrict discovery to variable names ending in _FILE.

The grep '_FILE=' pattern matches names such as CACHE_FILE_BACKUP, while ${var%_FILE} leaves those names unchanged. The script can then overwrite unrelated configuration variables with file contents. Extract and validate names first, then process only an exact _FILE suffix.

🧰 Tools
🪛 ast-grep (0.44.1)

[error] 38-38: eval is invoked on a variable, parameter expansion, or command-substitution result, which re-parses the value as shell code. If any part of that value is attacker-controlled (arguments, environment, file contents, network output), it allows arbitrary command execution. Do not eval dynamic data: invoke the command directly with proper quoting (e.g. "$cmd" "$arg"), use arrays for argument lists (cmd=(prog --flag "$value"); "${cmd[@]}"), or restrict input to a validated allowlist before running it.
Context: eval echo $$var
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(eval-on-variable-bash)

🪛 Shellcheck (0.11.0)

[info] 39-39: Double quote to prevent globbing and word splitting.

(SC2086)

[warning] 42-42: Quote this to prevent word splitting.

(SC2046)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packaging/docker/entrypoint.sh` around lines 38 - 42, Update the
environment-variable discovery loop in the entrypoint script to extract and
validate variable names before processing them, accepting only names whose
suffix is exactly _FILE. Ensure names such as CACHE_FILE_BACKUP are excluded,
while preserving the existing file existence check and export behavior for valid
variables.

echo "✓ Loaded $var_name from $file_path"
elif [ -n "$file_path" ]; then
echo "⚠ Warning: File $file_path not found for $var"
fi
done

exec su-exec "$USER_ID:$GROUP_ID" "$@"