CVE-2023-1712: Use of Hard-coded, Security-relevant Constants (CWE-547)
value: Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.
CWE description: The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
CVSS v3 base score: 9.8
Published: 2023-03-30T10:15Z
Repository: https://github.com/deepset-ai/haystack
Language: YAML
Files changed: annotation_tool/README.md, annotation_tool/docker-compose.yml
Commit date: 2023-03-29 12:54:21 +0200
Commit message: fix: update envs for the backend image of annotation tool (#4535)


Diff: diff --git a/annotation_tool/README.md b/annotation_tool/README.md
index 574604dc..29fbbc3d 100644
--- a/annotation_tool/README.md
+++ b/annotation_tool/README.md
@@ -17,18 +17,21 @@
 The credentials should match in database image and application configuration.
 
     DEFAULT_ADMIN_EMAIL: "example@example.com"
     DEFAULT_ADMIN_PASSWORD: "DEMO-PASSWORD"
 
-    PROD_DB_NAME: "databasename"
-    PROD_DB_USERNAME: "somesafeuser"
-    PROD_DB_PASSWORD: "somesafepassword"
-
+    DB_HOSTNAME: "db"
+    DB_NAME: "databasename"
+    DB_USERNAME: "somesafeuser"
+    DB_PASSWORD: "somesafepassword"
 
     POSTGRES_USER: "somesafeuser"
     POSTGRES_PASSWORD: "somesafepassword"
     POSTGRES_DB: "databasename"
+    
+    COOKIE_KEYS: "somesafecookiekeys"
+    JWT_SECRET: "somesafesecret"
 
 
 2. Run docker-compose by executing `docker-compose up`.
 
 
diff --git a/annotation_tool/docker-compose.yml b/annotation_tool/docker-compose.yml
index 8cd3d2fc..044004ed 100644
--- a/annotation_tool/docker-compose.yml
+++ b/annotation_tool/docker-compose.yml
@@ -1,17 +1,20 @@
 version: "3"
 services:
   backend:
     image: deepset/haystack-annotation:latest
     environment:
-      DEFAULT_ADMIN_EMAIL: "example@example.com"
-      DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
       NODE_ENV: "production"
-      PROD_DB_HOSTNAME: "db"
-      PROD_DB_NAME: "databasename"
-      PROD_DB_USERNAME: "somesafeuser"
-      PROD_DB_PASSWORD: "somesafepassword"
+      DB_HOSTNAME: "db"
+      DB_NAME: "databasename"
+      DB_USERNAME: "somesafeuser"
+      DB_PASSWORD: "somesafepassword"
+      # IMPORTANT: please configure credentials with secure strings.
+      # DEFAULT_ADMIN_EMAIL: "example@example.com"
+      # DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
+      # COOKIE_KEYS: "somesafecookiekeys"
+      # JWT_SECRET: "somesafesecret"
     ports:
       - "7001:7001"
     links:
       - "db:database"
     depends_on:

Vulnerable code:     PROD_DB_NAME: "databasename"
    PROD_DB_USERNAME: "somesafeuser"
    PROD_DB_PASSWORD: "somesafepassword"

      DEFAULT_ADMIN_EMAIL: "example@example.com"
      DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
      PROD_DB_HOSTNAME: "db"
      PROD_DB_NAME: "databasename"
      PROD_DB_USERNAME: "somesafeuser"
      PROD_DB_PASSWORD: "somesafepassword"
Fixed code:     DB_HOSTNAME: "db"
    DB_NAME: "databasename"
    DB_USERNAME: "somesafeuser"
    DB_PASSWORD: "somesafepassword"
    
    COOKIE_KEYS: "somesafecookiekeys"
    JWT_SECRET: "somesafesecret"
      DB_HOSTNAME: "db"
      DB_NAME: "databasename"
      DB_USERNAME: "somesafeuser"
      DB_PASSWORD: "somesafepassword"
      # IMPORTANT: please configure credentials with secure strings.
      # DEFAULT_ADMIN_EMAIL: "example@example.com"
      # DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
      # COOKIE_KEYS: "somesafecookiekeys"
      # JWT_SECRET: "somesafesecret"