Skip to content

Escape and quote all passwords in ERB templates

Hossein Pursultani requested to merge 1214-quote-passwords into master

This MR ensures that the content of all password files in ERB templates are: stripped using, escaped, and quoted.

For stripping it uses String#strip to remove heading and trailing white spaces including empty lines. In majority of cases string literals are escaped with String#dump. For URIs URI#escape is used.

To verify:

  1. Edit a password secrets, e.g. RELEASE-postgresql-password, and set it to something like foo"\n\t bar (add extra line breaks too).
  2. Refresh a deployment that uses the secret, e.g. RELEASE-unicorn.
  3. Check the content of ERB template output, e.g. in /srv/gitlab/config/database.yml of dependencies container of Unicorn pods.
  4. The password should be escaped, e.g. foo\"\\n\\tbar.

Closes #1214 (closed)

Edited by Hossein Pursultani

Merge request reports