Security: entrypoint.sh uses unvalidated PORT variable in sed command — potential DoS

[LucasMaupin]

Summary

scripts/entrypoint.sh runs sed -i "s/listen\s*8080;/listen $LISTENPORT;/" without validating the $LISTENPORT (derived from $PORT) value. If the variable contains a forward slash, the sed command fails and the container cannot start.

Location

• scripts/entrypoint.sh lines 2–4

Details

If PORT contains a forward slash (e.g., 3000/tcp as set by some container runtimes), the sed command fails with "unterminated substitution" and the container enters a crash loop (DoS).

While PORT is typically set by the platform rather than end users, lack of input validation is a hardening gap. The script runs as root (related to issue #648), which amplifies the impact if PORT were somehow controllable.

Recommendation

Validate PORT before using it in sed:

if [[ ! "$LISTENPORT" =~ ^[0-9]+$ ]]; then
  echo "Invalid PORT value: $LISTENPORT" >&2
  exit 1
fi

Or use envsubst with a prepared nginx config template instead of sed string replacement.

Severity

LOW