joinmarket-webui / joinmarket-webui/jam-docker
Password is visible in plaintext as value of an environment variable inside docker container
- Dominant language
- Dockerfile
- Stars
- 14
- Forks
- 10
- Avg merge
- 3h 44m
- Merged PRs (30d)
- 3
Description
**Expected behavior**
As a best security practice, no passwords should be kept anywhere on the system in plaintext.
**Actual behavior**
After creating a docker container per instructions here: https://jamdocs.org/software/installation/#manual-installation I've observed that plaintext password is visible inside docker container as value of APP_PASSWORD environment variable.
I have also verified the same holds true in a docker container on Umbrel.
**Steps to reproduce the problem**
See above
**Specifications**
- Version: 0.3.0
- Platform: Ubuntu
- Version: 0.3.0
- Platform: Umbrel
**Additional context**
As a general rule, only hash of password should be kept in persistent storage and password verification should be done by hashing input password and comparing it with stored hash.
Additional reading: https://cwe.mitre.org/data/definitions/256.html
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.