{"action":"opened","issue":{"url":"https://api.github.com/repos/Alfresco/chef-alfresco/issues/78","repository_url":"https://api.github.com/repos/Alfresco/chef-alfresco","labels_url":"https://api.github.com/repos/Alfresco/chef-alfresco/issues/78/labels{/name}","comments_url":"https://api.github.com/repos/Alfresco/chef-alfresco/issues/78/comments","events_url":"https://api.github.com/repos/Alfresco/chef-alfresco/issues/78/events","html_url":"https://github.com/Alfresco/chef-alfresco/issues/78","id":164185470,"number":78,"title":"Security Issue(?)","user":{"login":"mtwallach","id":11098119,"avatar_url":"https://avatars.githubusercontent.com/u/11098119?v=3","gravatar_id":"","url":"https://api.github.com/users/mtwallach","html_url":"https://github.com/mtwallach","followers_url":"https://api.github.com/users/mtwallach/followers","following_url":"https://api.github.com/users/mtwallach/following{/other_user}","gists_url":"https://api.github.com/users/mtwallach/gists{/gist_id}","starred_url":"https://api.github.com/users/mtwallach/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtwallach/subscriptions","organizations_url":"https://api.github.com/users/mtwallach/orgs","repos_url":"https://api.github.com/users/mtwallach/repos","events_url":"https://api.github.com/users/mtwallach/events{/privacy}","received_events_url":"https://api.github.com/users/mtwallach/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-06T22:04:50Z","updated_at":"2016-07-06T22:04:50Z","closed_at":null,"body":"Someone using chef-alfresco had been working with some Chef Engineers and they pointed out possible security issue(?):\r\nBased on consultation with Chef this week and whilst working on some details to build a wrapper for chef-alfresco we came across a security issue.\r\n \r\nThe problem in a nutshell is that attributes are being used set information that should be set via data bag’s or variables generated during the chef-client run.\r\nAttributes available to anyone with access to the system which is very bad as far as I can tell ;) .\r\nThis presents a difficult problem for my team.\r\n\r\nIdeally I would like to be able to wrap the chef-alfresco cookbook with our own; without applying any monkey patches,\r\nsince this negates the initial advantages gained by wrapping the code as opposed to modifying our own version and trying to keep them in sync. \r\nIdeally we should be able to wrap your cookbook without exposing sensitive information to users.\r\n\r\nAs an example if you type password into the search criteria in the git hub project you will find a number of examples where default password information is passed into and attribute.\r\nAccording to Chef attributes should only be used for persistent data and not for values that should be secret or dynamic.\r\n\r\nCan provide example if needed"}}
{"actor":{"display_login":"mtwallach"}}