You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
regression: password via RO bind-mount at /run/secrets/db_password (not masked putArchive) - #9
Rebased onto latest main after #8 squash-merge (fixes#7). Regression locks so tmpfs-masked putArchive delivery cannot return.
Asserted
RO bind-mount of a host temp file at /run/secrets/db_password
onCreate snapshots the bind Source as a file whose contents are the password
HostConfig.Mounts is Type: bind, ReadOnly: true, target /run/secrets/db_password
noputArchive and no tmpfs covering /run/secrets
Password never in Env — create/start Env has no DB_PASS / PGPASSWORD / MYSQL_PWD / PASSWORD, and inspect JSON does not contain the secret
Fail closed — readPassword throws on missing or empty secret even when payload.password is present. Message is the post-fix: bind-mount DB password so the runner can read it #8 bind-mounted text (Database password missing (expected bind-mounted secret at /run/secrets/db_password)), not “tmpfs”. secrets.js / execute.js do not read payload.password.
The reason will be displayed to describe this comment to others. Learn more.
Verdict
Solid regression stack on #8. Locks RO bind file at /run/secrets/db_password, forbids putArchive+tmpfs cover, Env/start opts scrubbed, empty+missing secret fail-closed with no payload.password fallback. Empty-file reject in secrets.js is a good tighten.
Finding
Should-fix (with #8 nit): new empty-secret test asserts /tmpfs secret file/, which locks the stale wording. Update the throw text (drop "tmpfs") and the regex in the same change — don’t merge the lock of the wrong noun.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking comment: Cursor Bugbot was present but completed as skipped, so this PR is not approved. Human review is needed. Reviewers were not assigned because no eligible non-author reviewers were available.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Assert host-file RO bind at /run/secrets/db_password with no Env
password and no putArchive. Fail-closed missing/empty secrets use the
bind-mounted error text (not tmpfs).
Co-authored-by: zhangjing <zhangjing798@qq.com>
Should-fix cleared. Empty/missing secret asserts use post-#8 bind-mounted message; explicit doesNotMatch(/tmpfs/i). RO bind file / no putArchive / no Env still locked. Empty-file fail-closed in secrets.js is fine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ChuTingzj
left a comment
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Rebased onto latest
mainafter #8 squash-merge (fixes #7). Regression locks so tmpfs-maskedputArchivedelivery cannot return.Asserted
/run/secrets/db_passwordonCreatesnapshots the bindSourceas a file whose contents are the passwordHostConfig.MountsisType: bind,ReadOnly: true, target/run/secrets/db_passwordputArchiveand no tmpfs covering/run/secretsEnvhas noDB_PASS/PGPASSWORD/MYSQL_PWD/PASSWORD, and inspect JSON does not contain the secretreadPasswordthrows on missing or empty secret even whenpayload.passwordis present. Message is the post-fix: bind-mount DB password so the runner can read it #8 bind-mounted text (Database password missing (expected bind-mounted secret at /run/secrets/db_password)), not “tmpfs”.secrets.js/execute.jsdo not readpayload.password.How to run
pnpm test pnpm typecheckLocal: 53 tests, all passing. No version tag.