{"action":"closed","issue":{"url":"https://api.github.com/repos/cloudfoundry/dea_ng/issues/144","labels_url":"https://api.github.com/repos/cloudfoundry/dea_ng/issues/144/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/dea_ng/issues/144/comments","events_url":"https://api.github.com/repos/cloudfoundry/dea_ng/issues/144/events","html_url":"https://github.com/cloudfoundry/dea_ng/issues/144","id":40381026,"number":144,"title":"A $ in service credentials does a BASH variable substitution","user":{"login":"mheath","id":9087,"avatar_url":"https://avatars.githubusercontent.com/u/9087?v=3","gravatar_id":"","url":"https://api.github.com/users/mheath","html_url":"https://github.com/mheath","followers_url":"https://api.github.com/users/mheath/followers","following_url":"https://api.github.com/users/mheath/following{/other_user}","gists_url":"https://api.github.com/users/mheath/gists{/gist_id}","starred_url":"https://api.github.com/users/mheath/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mheath/subscriptions","organizations_url":"https://api.github.com/users/mheath/orgs","repos_url":"https://api.github.com/users/mheath/repos","events_url":"https://api.github.com/users/mheath/events{/privacy}","received_events_url":"https://api.github.com/users/mheath/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2014-08-15T20:22:40Z","updated_at":"2015-02-10T23:22:33Z","closed_at":"2015-02-10T23:22:33Z","body":"We have a situation where a user tried to use a password with a $ in it in their user provided service credentials and instead of getting the $ in their VCAP_SERVICES, the $ and everything after it disappeared. I have been able to confirm that a variable substitution is happening in this case.\r\n\r\nI have been able to patch it by modifying https://github.com/cloudfoundry/dea_ng/blob/master/lib/dea/env/exporter.rb to have the following:\r\n\r\n```ruby\r\n        variables.map do |(key, value)|\r\n+          if key == \"VCAP_SERVICES\" || key == \"VCAP_APPLICATION\"\r\n+            value = value.to_s.gsub('$', '\\$')\r\n+          end\r\n          %Q{export %s=\"%s\";\\n} % [key, value.to_s.gsub('\"', '\\\"')]\r\n```\r\n\r\nHowever, I'm not convinced this is the best solution since it doesn't escape everything. (I don't think a back tick '`' will work, for example.)\r\n\r\nI singled out VCAP_SERVICES out of concern that some values may want variable substitution but I'm not sure.\r\n\r\nRegardless, this is an issue that will likely affect other users."}}