#31 Improved randomness of downloading - #36
Conversation
- Generate the download file at container startup instead of build time; fresh data per deployment and ~30MB smaller image. - Add WITHOUT_LETSENCRYPT build arg to skip certbot/dcron/crond (~65MB smaller); entrypoint and renew scripts fail fast if Let's Encrypt is requested without certbot.
| ARG FILE_SIZE=31457280 | ||
| ARG FILE_NAME=downloading | ||
| ENV FILE_SIZE=${FILE_SIZE} | ||
| ENV FILE_NAME=${FILE_NAME} |
There was a problem hiding this comment.
thinking security wise, any sanity checking needed here to avoid buffer overflow ? Could I enter a string ../../../etc/password for example to the file_name kind of thing. Like the flexibility - wondered if anyone else thought there may need some guardrails around it.
There was a problem hiding this comment.
I had removed the FILE__NAME as the frontend would not be able to change to the mentioned here and there is no actual benefit of changing it as far as I know. You're correct, the risks of escaping with ../../ might be valid too. (Although this is a variable for Dockerfile which the user who builds the image would set. Doesn't get expose anything either way)
Allow me apply the latest patches I made.
| && chmod 400 /etc/nginx/nginx.conf \ | ||
| && chmod +x /entrypoint.sh \ | ||
| && chown -R nginx /usr/share/nginx/html/ \ | ||
| && chmod 755 /usr/share/nginx/html/upload \ |
There was a problem hiding this comment.
I always wondered why this file had execute permissions, would it work just the same as 0744 ?
2 participants
Dear @openspeedtest
Please review these changes and merge if you see fit
Thanks for creating and maintaining this project. <3