Skip to content

Entrypoint escaping was breaking passwords with control characters for sed#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jonbartels wants to merge 3 commits into
base:main
Choose a base branch
from
Open

Entrypoint escaping was breaking passwords with control characters for sed #8

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1034ee3
When passwords are read from env vars, they are handled by the entryp…
jonbartels Jul 2, 2026
5655eb7
Restore custom downloads
jonbartels Jul 2, 2026
3f2a878
typo
jonbartels Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 48 additions & 56 deletions deploy/entrypoint.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,84 +7,97 @@

set -e

APP_DIR=/opt/engine
APP_DIR=/opt/oie

@tonygermanotonygermanoJul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: is this supposed to change?

There was no reference to it in the commit messages. Probably should be a separate commit if intentional.


custom_extension_count=`ls -1 "$APP_DIR"/custom-extensions/*.zip 2>/dev/null | wc -l`
if [ $custom_extension_count != 0 ]; then
echo "Found ${custom_extension_count} custom extensions."
for extension in $(ls -1 "$APP_DIR"/custom-extensions/*.zip); do
unzip -o -q $extension -d "$APP_DIR/extensions"
done
fi
Comment on lines -12 to -18

@tonygermanotonygermanoJul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: was this section intentionally deleted?

It doesn't look like it was moved elsewhere in the file.

# Set (or append) a property in a Java .properties file.
#
# set_property <key> <value> <file>
#
# The value is passed through the environment and read via awk's ENVIRON, so it
# is treated as a literal string. This avoids the sed replacement pitfalls where
# '&', '\' and '/' are special (e.g. a DATABASE_PASSWORD containing '&' would
# otherwise be expanded to the matched text and corrupt the file).
set_property() {
local key=$1
local value=$2
local file=$3
# Escape regex metacharacters in the key so it matches literally.
local ekey
# shellcheck disable=SC2016 # single quotes are intentional; this is a sed program, not shell
ekey=$(printf '%s' "$key" | sed -e 's/[][\.*^$(){}?+|/-]/\\&/g')

VALUE="$value" awk -v pattern="^${ekey}[[:space:]]*=" -v name="$key" '
$0 ~ pattern { print name " = " ENVIRON["VALUE"]; found=1; next }
{ print }
END { if (!found) print name " = " ENVIRON["VALUE"] }
' "$file" > "$file.tmp" && mv "$file.tmp" "$file"
}

MIRTH_PROPERTIES="$APP_DIR/conf/mirth.properties"

# set storepass and keypass to 'changeme' so they aren't overwritten later
KEYSTORE_PASS=changeme
sed -i "s/^keystore\.storepass\s*=\s*.*\$/keystore.storepass = ${KEYSTORE_PASS//\//\\/}/" "$APP_DIR/conf/mirth.properties"
sed -i "s/^keystore\.keypass\s*=\s*.*\$/keystore.keypass = ${KEYSTORE_PASS//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "keystore.storepass" "$KEYSTORE_PASS" "$MIRTH_PROPERTIES"
set_property "keystore.keypass" "$KEYSTORE_PASS" "$MIRTH_PROPERTIES"

# merge the environment variables into /opt/engine/conf/mirth.properties
# merge the environment variables into mirth.properties
# db type
if ! [ -z "${DATABASE+x}" ]; then
sed -i "s/^database\s*=\s*.*\$/database = ${DATABASE//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database" "$DATABASE" "$MIRTH_PROPERTIES"
fi

# db username
if ! [ -z "${DATABASE_USERNAME+x}" ]; then
sed -i "s/^database\.username\s*=\s*.*\$/database.username = ${DATABASE_USERNAME//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database.username" "$DATABASE_USERNAME" "$MIRTH_PROPERTIES"
fi

# db password
if ! [ -z "${DATABASE_PASSWORD+x}" ]; then
sed -i "s/^database\.password\s*=\s*.*\$/database.password = ${DATABASE_PASSWORD//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database.password" "$DATABASE_PASSWORD" "$MIRTH_PROPERTIES"
fi

# db url
if ! [ -z "${DATABASE_URL+x}" ]; then
sed -i "s/^database\.url\s*=\s*.*\$/database.url = ${DATABASE_URL//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database.url" "$DATABASE_URL" "$MIRTH_PROPERTIES"
fi

# database max connections
if ! [ -z "${DATABASE_MAX_CONNECTIONS+x}" ]; then
sed -i "s/^database\.max-connections\s*=\s*.*\$/database.max-connections = ${DATABASE_MAX_CONNECTIONS//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database.max-connections" "$DATABASE_MAX_CONNECTIONS" "$MIRTH_PROPERTIES"
fi

# database max retries
if ! [ -z "${DATABASE_MAX_RETRY+x}" ]; then
sed -i "s/^database\.connection\.maxretry\s*=\s*.*\$/database.connection.maxretry = ${DATABASE_MAX_RETRY//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database.connection.maxretry" "$DATABASE_MAX_RETRY" "$MIRTH_PROPERTIES"
fi

# database retry wait time
if ! [ -z "${DATABASE_RETRY_WAIT+x}" ]; then
sed -i "s/^database\.connection\.retrywaitinmilliseconds\s*=\s*.*\$/database.connection.retrywaitinmilliseconds = ${DATABASE_RETRY_WAIT//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "database.connection.retrywaitinmilliseconds" "$DATABASE_RETRY_WAIT" "$MIRTH_PROPERTIES"
fi

# keystore storepass
if ! [ -z "${KEYSTORE_STOREPASS+x}" ]; then
sed -i "s/^keystore\.storepass\s*=\s*.*\$/keystore.storepass = ${KEYSTORE_STOREPASS//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "keystore.storepass" "$KEYSTORE_STOREPASS" "$MIRTH_PROPERTIES"
fi

# keystore keypass
if ! [ -z "${KEYSTORE_KEYPASS+x}" ]; then
sed -i "s/^keystore\.keypass\s*=\s*.*\$/keystore.keypass = ${KEYSTORE_KEYPASS//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "keystore.keypass" "$KEYSTORE_KEYPASS" "$MIRTH_PROPERTIES"
fi

if ! [ -z "${KEYSTORE_TYPE+x}" ]; then
sed -i "s/^keystore\.type\s*=\s*.*\$/keystore.type = ${KEYSTORE_TYPE//\//\\/}/" "$APP_DIR/conf/mirth.properties"
set_property "keystore.type" "$KEYSTORE_TYPE" "$MIRTH_PROPERTIES"
fi

# session store
if ! [ -z "${SESSION_STORE+x}" ]; then
LINE_COUNT=`grep "server.api.sessionstore" "$APP_DIR/conf/mirth.properties" | wc -l`
if [ $LINE_COUNT -lt 1 ]; then
echo -e "\nserver.api.sessionstore = ${SESSION_STORE//\//\\/}" >> "$APP_DIR/conf/mirth.properties"
else
sed -i "s/^server\.api\.sessionstore\s*=\s*.*\$/server.api.sessionstore = ${SESSION_STORE//\//\\/}/" "$APP_DIR/conf/mirth.properties"
fi
set_property "server.api.sessionstore" "$SESSION_STORE" "$MIRTH_PROPERTIES"
fi

#server ID
if ! [ -z "${SERVER_ID+x}" ]; then
echo -e "server.id = ${SERVER_ID//\//\\/}" > "$APP_DIR/appdata/server.id"
printf 'server.id = %s\n' "$SERVER_ID" > "$APP_DIR/appdata/server.id"
fi

# merge extra environment variables starting with _MP_ into mirth.properties
Expand DownExpand Up@@ -118,21 +131,12 @@ while read -r keyvalue; do
# example: database.max-connections
ACTUAL_KEY="${ACTUAL_KEY,,}"

# if key does not exist in mirth.properties append it at bottom
LINE_COUNT=`grep "^${ACTUAL_KEY}" "$APP_DIR/conf/mirth.properties" | wc -l`
if [ $LINE_COUNT -lt 1 ]; then
# echo "key ${ACTUAL_KEY} not found in mirth.properties, appending. Value = ${VALUE}"
echo -e "\n${ACTUAL_KEY} = ${VALUE//\//\\/}" >> "$APP_DIR/conf/mirth.properties"
else # otherwise key exists, overwrite it
# echo "key ${ACTUAL_KEY} exists, overwriting. Value = ${VALUE}"
ESCAPED_KEY="${ACTUAL_KEY//./\\.}"
sed -i "s/^${ESCAPED_KEY}\s*=\s*.*\$/${ACTUAL_KEY} = ${VALUE//\//\\/}/" "$APP_DIR/conf/mirth.properties"
fi
set_property "${ACTUAL_KEY}" "${VALUE}" "$MIRTH_PROPERTIES"
fi
fi
done <<< "`printenv`"
done <<< "$(printenv)"

# merge vmoptions into /opt/engine/oieserver.vmoptions
# merge vmoptions into oieserver.vmoptions
if ! [ -z "${VMOPTIONS+x}" ]; then
PREV_IFS="$IFS"
IFS=","
Expand All@@ -146,12 +150,9 @@ if ! [ -z "${VMOPTIONS+x}" ]; then
fi

# merge the user's secret mirth.properties
# takes a whole mirth.properties file and merges line by line with /opt/engine/conf/mirth.properties
# takes a whole mirth.properties file and merges line by line with mirth.properties
if [ -f /run/secrets/mirth_properties ]; then

# add new line in case /opt/engine/conf/mirth.properties doesn't end with one
echo "" >> "$APP_DIR/conf/mirth.properties"

while read -r keyvalue; do
KEY="${keyvalue%%=*}"
VALUE="${keyvalue#*=}"
Expand All@@ -161,22 +162,13 @@ if [ -f /run/secrets/mirth_properties ]; then
VALUE="$(echo -e "${VALUE}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"

if ! [ -z "${KEY}" ] && ! [ -z "${VALUE}" ] && ! [[ ${VALUE} =~ ^\ +$ ]]; then
# if key does not exist in mirth.properties append it at bottom
LINE_COUNT=`grep "^${KEY}" "$APP_DIR/conf/mirth.properties" | wc -l`
if [ $LINE_COUNT -lt 1 ]; then
# echo "key ${KEY} not found in mirth.properties, appending. Value = ${VALUE}"
echo -e "${KEY} = ${VALUE//\//\\/}" >> "$APP_DIR/conf/mirth.properties"
else # otherwise key exists, overwrite it
# echo "key ${KEY} exists, overwriting. Value = ${VALUE}"
ESCAPED_KEY="${KEY//./\\.}"
sed -i "s/^${ESCAPED_KEY}\s*=\s*.*\$/${KEY} = ${VALUE//\//\\/}/" "$APP_DIR/conf/mirth.properties"
fi
set_property "${KEY}" "${VALUE}" "$MIRTH_PROPERTIES"
fi
done <<< "`cat /run/secrets/mirth_properties`"
done <<< "$(cat /run/secrets/mirth_properties)"
fi

# merge the user's secret vmoptions
# takes a whole oieserver.vmoptions file and merges line by line with /opt/engine/oieserver.vmoptions
# takes a whole oieserver.vmoptions file and merges line by line with oieserver.vmoptions
if [ -f /run/secrets/oieserver_vmoptions ]; then
(cat /run/secrets/oieserver_vmoptions ; echo "") >> "$APP_DIR/oieserver.vmoptions"
fi
Expand Down