You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The convert function in the bridge package creates a temporary compose.yaml file to be used by transformation containers but fails to remove it after execution. Furthermore, it uses a fixed filename in the system's temporary directory, leading to potential race conditions and execution failures on certain platforms (like macOS).
Steps To Reproduce
Run docker compose bridge convert --output ./out-test on any Compose project.
Check the system temporary directory:
On macOS: ls -l $TMPDIR/compose.yaml
On Linux: ls -l /tmp/compose.yaml
Observe that the file exists and contains the marshaled project configuration.
Run the command again and notice it overwrites the same file.
Actual terminal output (macOS):
% docker compose bridge convert --output ./out-test
% ls -l $TMPDIR/compose.yaml
-rw-------@ 1 user staff 192 Dec 29 21:19 /var/folders/.../T//compose.yaml
Security Risk: The leaked file contains the full project model, which may include sensitive information if types.WithSecretContent is used during marshaling.
Description
The convert function in the bridge package creates a temporary compose.yaml file to be used by transformation containers but fails to remove it after execution. Furthermore, it uses a fixed filename in the system's temporary directory, leading to potential race conditions and execution failures on certain platforms (like macOS).
Steps To Reproduce
Run docker compose bridge convert --output ./out-test on any Compose project.
Check the system temporary directory:
On macOS: ls -l $TMPDIR/compose.yaml
On Linux: ls -l /tmp/compose.yaml
Observe that the file exists and contains the marshaled project configuration.
Run the command again and notice it overwrites the same file.
Actual terminal output (macOS):
% docker compose bridge convert --output ./out-test % ls -l $TMPDIR/compose.yaml -rw-------@ 1 user staff 192 Dec 29 21:19 /var/folders/.../T//compose.yamlCompose Version
Docker Environment
Anything else?
Security Risk: The leaked file contains the full project model, which may include sensitive information if
types.WithSecretContentis used during marshaling.