Skip to content

[Security] Password revealed in process list #39

@leprasmurf

Description

@leprasmurf

When I deploy via webistrano, I am prompted for my SVN username and password. If I'm on the webistrano server during a deploy, and check the process listing, my password is displayed in clear text.

Webistrano version:
Version 1.5

OS version:
CentOS 5.6

Example PS output (username, servername, and password removed for obvious reasons):
@:~$ ps aux|grep -i webistrano
root 29642 0.0 0.0 4576 1000 ? S 09:52 0:00 sh -c cd /var/www/apps/webistrano && ruby script/runner -e production ' deployment = Deployment.find(1887); deployment.prompt_config = {"scm_username"=>"", "scm_password"=>""} ; Webistrano::Deployer.new(deployment).invoke_task! ' >> /var/www/apps/webistrano/log/production.log 2>&1
root 29643 4.0 0.9 44848 39816 ? S 09:52 0:01 ruby script/runner -e production deployment = Deployment.find(1887); deployment.prompt_config = {"scm_username"=>"", "scm_password"=>""} ; Webistrano::Deployer.new(deployment).invoke_task!
29652 0.0 0.0 4016 748 pts/4 S+ 09:53 0:00 grep --color=auto -i webistrano

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions