bitwalker / bitwalker/distillery

`${u*}` in cookie causes all commands to enter an infinite loop

Open
#727 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Elixir
Stars
3k
Forks
398
PR merge metrics
No merged PRs in 30d

Description

### Steps to reproduce

Modify the cookie in rel/config.exs to contain `${u*}` somewhere. For example, in my case, the auto-generated cookie looked like this
```
set cookie: :"n/vHdl01.<)Sd23@0SV~=snk${RXu*W83z}Rqd;OWL]C3h6EhZuJ!^:4Cf$@Ke?g"
```

Then run the following commands
```
rm -rf _build/
MIX_ENV=prod mix distillery.release --env=prod
_build/prod/rel/$APP_NAME/bin/$APP_NAME help
```

Notice how the command hangs forever with no output.

### Verbose Logs

Adding `--verbose` also just hung with no output.

### Description of issue

It seems that this special combination of characters is a valid generated cookie according to [this function](https://github.com/bitwalker/distillery/blob/2.1.1/lib/distillery/cookies.ex#L30).

Later, when we try to [fetch the node name](https://github.com/bitwalker/distillery/blob/2.1.1/priv/libexec/config.sh#L251), it runs [this awk command](https://github.com/bitwalker/distillery/blob/2.1.1/priv/libexec/config.sh#L201) which never ends.

I haven't dug into whether the awk command can be tweaked to prevent this, but that's also a possibility. I think the easiest fix is to make this special combination of characters an invalid cookie. Perhaps, the easiest way is to add `$`, `{`, or `}` to the rejected character list.

- What are the expected results? To either not hang, or never generate a cookie that causes a hang.
- What version of Distillery? 2.1.1
- What OS, Erlang/Elixir versions are you seeing this issue on? 1.8.1/20.1

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.