peritor/webistrano — Issue #39: [Security] Password revealed in process list
Author: leprasmurf
Created: 2011-10-18 14:33:32+00:00
State: open

When I deploy via webistrano, I am prompted for my SVN username and password. If I'm on the webistrano server during a deploy, and check the process listing, my password is displayed in clear text.

Webistrano version:
Version 1.5

OS version:
CentOS 5.6

Example PS output (username, servername, and password removed for obvious reasons):
@:~$ ps aux|grep -i webistrano
root 29642 0.0 0.0 4576 1000 ? S 09:52 0:00 sh -c cd /var/www/apps/webistrano && ruby script/runner -e production ' deployment = Deployment.find(1887); deployment.prompt_config = {"scm_username"=>"", "scm_password"=>""} ; Webistrano::Deployer.new(deployment).invoke_task! ' >> /var/www/apps/webistrano/log/production.log 2>&1
root 29643 4.0 0.9 44848 39816 ? S 09:52 0:01 ruby script/runner -e production deployment = Deployment.find(1887); deployment.prompt_config = {"scm_username"=>"", "scm_password"=>""} ; Webistrano::Deployer.new(deployment).invoke_task!
29652 0.0 0.0 4016 748 pts/4 S+ 09:53 0:00 grep --color=auto -i webistrano