docker-library / docker-library/mysql
Unable to Run with Apostrophe in Password
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 2.6k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
If the MYSQL_ROOT_PASSWORD value contains an apostrophe or single quote ('), the image fails to run whatsoever.
I'm not sure if this would be considered a vulnerability, as only the administrator would have access to the Docker Compose file. However, it is a bother when one has a seemingly simple configuration, and turns out it was just the choice of password messing things up.
version: "3.9"
services:
mysql:
image: mysql:5.7.34
environment:
MYSQL_ROOT_PASSWORD: "No! Don't! Anything but the apostrophe!"
MYSQL_DATABASE: NeverGonnaGiveYouUp
MYSQL_USER: NeverGonnaLetYouDown
MYSQL_PASSWORD: "Never gonna run around and desert you"
Logs:
mysql_1 | ERROR 1064 (42000) at line 5: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 't! Anything but the apostrophe!' ;
The following works, and instead of using this as the password, it actually executes my SELECT.
version: "3.9"
services:
mysql:
image: mysql:5.7.34
environment:
MYSQL_ROOT_PASSWORD: "Rick'; SELECT 'Astley';"
MYSQL_DATABASE: NeverGonnaGiveYouUp
MYSQL_USER: NeverGonnaLetYouDown
MYSQL_PASSWORD: "Never gonna run around and desert you"
Logs:
mysql_1 | ERROR 1064 (42000) at line 5: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' ;
mysql_1 | GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
mysql_1 | FLUSH PRIVILEGES ' at line 1
mysql_1 | Astley
mysql_1 | Astley
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with the provided Docker Compose configuration and inspect the MySQL image's initialization output, especially the generated SQL around the password. Confirm the fix by using passwords containing apostrophes and SQL statements, ensuring the password is treated as data and the statement is not executed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, mysql, shell
- Domain
- databases, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100