joinmarket-webui / joinmarket-webui/jam-docker

Password is visible in plaintext as value of an environment variable inside docker container

Open
#149 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Dockerfile
Stars
14
Forks
10
Avg merge
3h 44m
Merged PRs (30d)
3

Description

**Expected behavior**

As a best security practice, no passwords should be kept anywhere on the system in plaintext.

**Actual behavior**

After creating a docker container per instructions here: https://jamdocs.org/software/installation/#manual-installation I've observed that plaintext password is visible inside docker container as value of APP_PASSWORD environment variable.

I have also verified the same holds true in a docker container on Umbrel.

**Steps to reproduce the problem**

See above

**Specifications**
- Version: 0.3.0
- Platform: Ubuntu

- Version: 0.3.0
- Platform: Umbrel

**Additional context**

As a general rule, only hash of password should be kept in persistent storage and password verification should be done by hashing input password and comparing it with stored hash.

Additional reading: https://cwe.mitre.org/data/definitions/256.html

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.