j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-10-18 00:50:07 +00:00
Code Issues Projects Releases Wiki Activity

fix(security): resolve reviewer findings on secret key baking, host symlinks, and injection safety

Browse source 
- Prevent baking SECRET_KEY into Docker image during collectstatic
- Persist runtime SECRET_KEY in data/secret_key volume or read from environment
- Remove sed-based injection of CSRF_TRUSTED_ORIGINS in favor of native os.getenv
- Avoid overwriting system python3 symlink on SUSE; auto-detect python 3.10+ binaries
- Make /etc/hosts entry in installer idempotent
- Add security notice regarding compute node VNC/SPICE port firewall isolation
This commit is contained in:
catborise 2026-09-25 22:06:16 +03:00
parent b1a843e846
commit 7435d66492
5 changed files with 42 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

23
conf/runit/10_webvirtcloud_init.sh
View file

@ -11,22 +11,13 @@ if [ ! -f "$APP_DIR/webvirtcloud/settings.py" ]; then
cp "$APP_DIR/webvirtcloud/settings.py.template" "$APP_DIR/webvirtcloud/settings.py"
fi
# Set SECRET_KEY if placeholder exists
if grep -q 'SECRET_KEY = ""' "$APP_DIR/webvirtcloud/settings.py" || grep -q "SECRET_KEY = ''" "$APP_DIR/webvirtcloud/settings.py"; then
KEY="${SECRET_KEY:-$("$APP_DIR/venv/bin/python3" -c 'import secrets; print(secrets.token_urlsafe(50))')}"
sed -i "s|^SECRET_KEY = .*|SECRET_KEY = \"${KEY}\"|" "$APP_DIR/webvirtcloud/settings.py"
fi
# Configure CSRF_TRUSTED_ORIGINS if environment variable is set
if [ -n "$CSRF_TRUSTED_ORIGINS" ]; then
echo "* Setting CSRF_TRUSTED_ORIGINS from environment..."
origins=""
IFS=',' read -ra ADDR <<< "$CSRF_TRUSTED_ORIGINS"
for o in "${ADDR[@]}"; do
clean_o=$(echo "$o" | xargs)
[ -n "$clean_o" ] && origins="${origins}'${clean_o}', "
done
sed -i "s|^CSRF_TRUSTED_ORIGINS = .*|CSRF_TRUSTED_ORIGINS = [ ${origins} ]|" "$APP_DIR/webvirtcloud/settings.py"
# Ensure SECRET_KEY is persisted across container restarts if not supplied via environment
if [ -z "$SECRET_KEY" ]; then
if [ ! -s "$DATA_DIR/secret_key" ]; then
echo "* Generating fresh random SECRET_KEY..."
"$APP_DIR/venv/bin/python3" -c 'import secrets; print(secrets.token_urlsafe(50))' > "$DATA_DIR/secret_key"
chmod 600 "$DATA_DIR/secret_key"
fi
fi
# Persist SQLite database in DATA_DIR