refactor: dont start supervisor when migrating db - #220
Conversation
Deploying rctf with
|
| Latest commit: |
92b40f4
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4270490a.rctf-new.pages.dev |
| Branch Preview URL: | https://es3n1n-dont-start-supervisor.rctf-new.pages.dev |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| run: ({ args }) => { | ||
| let value: unknown = config | ||
| for (const key of args.path.split('.')) { | ||
| if (value === null || typeof value !== 'object') { | ||
| value = undefined | ||
| break | ||
| } | ||
| value = (value as Record<string, unknown>)[key] | ||
| } | ||
|
|
||
| if (value === undefined) { | ||
| console.error(`No config value at '${args.path}'`) | ||
| process.exit(1) | ||
| } | ||
|
|
||
| const output = typeof value === 'string' ? value : JSON.stringify(value) | ||
| process.stdout.write(`${output}\n`) | ||
| }, |
There was a problem hiding this comment.
🟨 New CLI command can print secret configuration values to stdout
The new config get command prints any resolved configuration value at an arbitrary dot path, including secret material such as tokenKey, database/redis passwords, provider API keys, and CTFtime client secrets (apps/cli/src/commands/config/get.ts:16-32). Anyone able to run the CLI (e.g. docker exec rctf-rctf-1 rctf config get tokenKey) or a script that logs its output can trivially dump signing keys and credentials.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
well yeah that's intended. i don't think this gives any decent primitives if you exploited something though, because instead of calling the cli you can just directly read configs/envs
1 participant
resolves #180