[issue] entrypoint script does not escape password properly

[Celmor]

Type	Version/Name
MARIADB_VERSION	1:10.3.8+maria~jessie
Docker Image	mariadb:10.3.8@sha256:f2085c2176ba6294cf73033b344a420faa2ddae1b97b6795c101552e86284ba3
Docker Hosts Kernel Version	4.17.0-2-MANJARO
Docker Server Version	18.05.0-ce

Description

I've generated my password for MYSQL_ROOT_PASSWORD env var with keepass with all character ranges enabled. The container exits with

ERROR 1064 (42000) at line 6: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'Oe(]xI=<&(') ;
GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
CREATE' at line 1

Full log
where 'Oe(]xI=<&( was part of my MYSQL_ROOT_PASSWORD.

Steps to reproduce

Run sudo docker run --rm -e "MYSQL_ROOT_PASSWORD='Oe(]xI=<&(" mariadb:10.3.8@sha256:f2085c2176ba6294cf73033b344a420faa2ddae1b97b6795c101552e86284ba3

[yosifkit]

We don't escape any password characters since we didn't want to implement the equivalent of mysql_real_escape_string in bash and didn't want to burden the image with an install of a library/language just for this purpose.

https://github.com/docker-library/mariadb/blob/8818681187395ecf968ab61dfd8d04d458c356dc/docker-entrypoint.sh#L130

[Celmor]

@yosifkit Then the fact passwords won't be escaped (and have to be chosen appropriately) should be documented on the Docker Hub page.

[tianon]

This is essentially a duplicate of docker-library/mysql#338.

@ltangvald what're your thoughts? For postgres, we recently applied docker-library/postgres#489, which allowed us to pass variables directly to psql so that the user input could be properly escaped by psql itself -- does there already exist any similar method in mysql for implementing something like that which I'm not familiar with (and can't seem to find)? 🙏 (Maybe something like that on the roadmap for the future? 😅)

[ltangvald]

I think printf %q should be enough, actually: https://github.com/mysql/mysql-server/blob/8.0/packaging/deb-in/mysql-packagesource-server.postinst.in#L86

[ltangvald]

   %q     ARGUMENT is printed in a format that  can  be  reused  as  shell
          input, escaping non-printable characters with the proposed POSIX
          $'' syntax.

This escapes certain symbols that don't need to be escaped in MySQL, such as $, but MySQL handles that, so if the root password is set to 'mypa$s', printf %q will output 'mypa\$s', but the password will still be stored as 'mypa$s'

[tianon]

So, I don't think that'll work properly given that it outputs $'...' syntax sometimes:

$ printf '%q\n' "$(echo -e 'a \r b \n c \\ d '\'' e " f \x1a g')"
$'a \r b \n c \\ d \' e " f \032 g'

(Which I don't think is valid in MySQL, right?)

[ltangvald]

Does that work in postgres? i.e. setting the password to

"$(echo -e 'a \r b \n c \ d ''' e " f \x1a g')"

[yosifkit]

I got postgres to set the password without complaint but I can't get psql to authenticate using it in PGPASSWORD, so I am not sure which part failed (initial setting the password or using the password).

$ docker run -d -e POSTGRES_PASSWORD="$(echo -e 'a b \n c \\ d '\'' e " f \x1a g')" postgres:10

[ltangvald]

Right, the same happens with our deb packages (that use printf %q). I'm not sure we should try to support everything, but random password generators often output some special characters that need escaping.