[Question] [Dolphin] Printing plaintext passwords in process environment variables

[licanxue]

Search before asking

• I had searched in the issues and found no similar issues.

What happened

Printing plaintext passwords in process environment variables

What you expected to happen

no passwords showing in process environment variables

How to reproduce

Anything else

No response

Version

dev

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[SbloodyS]

Can you elaborate your issue? I don't quite understand what this is.

[licanxue]

We used DolphinScheduler as a scheduling tool in our project, and during our security testing we found that we executed the ‘ps -ef‘ command to query Dolphin's process on the machine where DolphinScheduler was installed, and then we viewed the process by the command ‘cat /proc/procId/environ‘ environment variable information, in which the password is shown in clear text, it is determined to be a security issue, may I ask how to fix it?

[SbloodyS]

I don't think this is a cve since most open source tools store the account password in plain text in the service's configuration file.