DeployerLocal adds all environment variables to command Line about spring-cloud-deployer-local HOT 4 CLOSED

@viniciusccarvalho Whitelisting args isn’t a valid solution. We need to not pass in all arguments as command line arguments. They should be set as environment vars.

from spring-cloud-deployer-local.

This approach also serves as a security issue. Command line args are stored plain text in the database (and are also available via ps -ef). Secure configurations like db credentials should not be passed as command line args and should only be available via environment variables (or other secure configuration options).

from spring-cloud-deployer-local.

@cppwfs I think the culprit is here correct? https://github.com/spring-cloud/spring-cloud-deployer-local/blob/master/spring-cloud-deployer-local/src/main/java/org/springframework/cloud/deployer/spi/local/AbstractLocalDeployerSupport.java#L200

@markpollack We may need to have some sort of white list args we want to pass here. Besides the debug stuff that was added, anything else comes to your mind?

from spring-cloud-deployer-local.

@viniciusccarvalho Sorry, I should have answered your question earlier. Here is the line that is causing our fun:

from spring-cloud-deployer-local.