# Discourse\_docker: discourse-setup makes sed parse SMTP password
**URL:** https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390
**Category:** Bug
**Created:** [November 3, 2017, 9:06pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390 "2017-11-03T21:06:57Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@tomreyn](https://meta.discourse.org/u/tomreyn)
#### Post date: [November 3, 2017, 9:06pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/1 "2017-11-03T21:06:57Z")
I previously posted this on the GitHub issue tracker which has now been removed (including my post), so I’m posting it here again.
discourse-setup uses sed to place the user provided SMTP password in the configuration file. The user input is used as a regular expression by sed (-e) there, while it is really just a plain text string.
This works as long as the password does not contain any characters which sed would interpret as an expression / command.
When it fails to work, the user may get to see a sed error message in the discourse-setup output, and installation may fail.
This is potentially a security issue, since sed might end up executing the input string (///e).
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [November 3, 2017, 9:09pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/2 "2017-11-03T21:09:01Z")
> [@tomreyn](#):
>
> I previously posted this on the GitHub issue tracker which has now been removed (including my post), so I’m posting it here again.
Sorry about that! We never intended to use GitHub Issues, it was left enabled unintentionally…but now you’re in the right place!
---
### Author:  [@tomreyn](https://meta.discourse.org/u/tomreyn)
#### Post date: [November 3, 2017, 9:15pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/3 "2017-11-03T21:15:44Z")
> [@jomaxro](#):
>
> Sorry about that! We never intended to use GitHub Issues, it was left enabled unintentionally…but now you’re in the right place!
I was fortunately able to reconstruct my reports from the cache of a web search engine. Since I had previously created an account here on [meta.discouse.org](http://meta.discouse.org) the extra effort I had to spend to migrate the reports here was limited. Other people who reported bugs on the GitHub issue tracker may not be able to gather the same motivation to migrate their reports to a separate site (which is not a common bug tracker) which they may not have an account on, yet.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 3, 2017, 9:31pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/4 "2017-11-03T21:31:16Z")
Sure @pfaffman can have a peek as he has time.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 3, 2017, 9:42pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/5 "2017-11-03T21:42:26Z")
> [@tomreyn](#):
>
> discourse-setup uses sed to place the user provided SMTP password in the configuration file. The user input is used as a regular expression by sed (-e) there, while it is really just a plain text string.
>
> This works as long as the password does not contain any characters which sed would interpret as an expression / command.
>
> When it fails to work, the user may get to see a sed error message in the discourse-setup output, and installation may fail.
Yeah. That all seems true. It’s fragile that way.
> [@tomreyn](#):
>
> This is potentially a security issue, since sed might end up executing the input string (///e).
That would require someone who is giving an admin an SMTP password to be evil, but you never know.
I suppose I should do this:
>
---
### Author:  [@tomreyn](https://meta.discourse.org/u/tomreyn)
#### Post date: [November 3, 2017, 10:15pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/6 "2017-11-03T22:15:31Z")
Even better might be to not interpret the (potentially untrusted) input as a plain text string, not a regular expression, as discussed at
>
This is, however, more complex, and depends on the GNU Bash shell (i.e. it is a “bashism”). The latter may not matter, though, since the script already states that it depends on
`#!/usr/bin/env bash`
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 25, 2018, 11:43pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/7 "2018-08-25T23:43:09Z")
Did this get addressed @pfaffman?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 27, 2018, 9:03pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/8 "2018-08-27T21:03:10Z")
At least mostly. Here’s what read\_config looks like now. The `sed` replacement mostly fixes up stuff that needs to be escaped.
```bash
read_config() {
config_line=`egrep "^ #?$1:" $web_file`
read_config_result=`echo $config_line | awk --field-separator=":" '{print $2}'`
read_config_result=`echo $read_config_result | sed "s/^\([\"']\)\(.*\)\1\$/\2/g"`
}
```
I think it now works at least with characters likely to be in a password. I don’t think I’ve seen any complaints about wonky passwords breaking `discourse-setup` in a long while.
I don’t consider this much of a security issue, as it would require either the sysadmin of the Discourse server or the sysadmin of the mail server to be malicious.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 27, 2018, 10:31pm UTC](https://meta.discourse.org/t/discourse-docker-discourse-setup-makes-sed-parse-smtp-password/73390/9 "2018-08-27T22:31:35Z")