Redact plaintext MySQL password from superset entrypoint logs

entrypoint.sh's set -euxo pipefail traced the fully-substituted
superset test_db command, including the plaintext mysql_superset_password
secret, to stderr. Separately, superset test_db itself prints the full
SQLAlchemy connection URI (with password) to stdout. Both ended up in
docker logs / docker service logs superset, and persisted indefinitely
in the host's json-file log driver.

Build the DB URI in a variable with -x off, and pipe test_db's combined
output through a literal-string redaction filter before it reaches
Docker's log driver. -x tracing resumes for the rest of the script.

Author: szachovy

CHANGELOG.md

@@ -39,6 +39,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* Redacted MySQL password from `superset` entrypoint's `test_db` output and disabled `-x` tracing around it,
+  preventing plaintext password exposure in `docker logs`/`docker service logs`.
 * Upload `.py` source instead of `.pyc` bytecode to decouple host Python version. (#38, #41)
 * Fixed `run_mysql_server()` not instantiating `MySQLServer` class. (#94)
 * Disabled MD060 markdownlint rule to fix table column style false positives in documentation. (#94)

services/superset/entrypoint.sh

@@ -1,11 +1,24 @@
 #!/bin/bash
 
-set -euxo pipefail
+set -euo pipefail
+
+DB_PASSWORD=$(< /run/secrets/mysql_superset_password)
+DB_URI="mysql+mysqlconnector://superset:${DB_PASSWORD}@${VIRTUAL_IP_ADDRESS}:6446/superset"
+
+# -x stays off here: tracing this line, or superset test_db's own "SQLAlchemy
+# URI" printout, would put the plaintext DB password into docker logs/docker
+# service logs. Redact stdout+stderr as a backstop in case anything
+# downstream still echoes the URI.
+if superset test_db "$DB_URI" --connect-args {} 2>&1 \
+    | DB_PASSWORD="$DB_PASSWORD" python3 -c '
+import os, sys
+pw = os.environ["DB_PASSWORD"]
+for line in sys.stdin:
+    sys.stdout.write(line.replace(pw, "<redacted>"))
+    sys.stdout.flush()
+'; then
+  set -x
 
-if superset test_db \
-    "mysql+mysqlconnector://superset:$(< /run/secrets/mysql_superset_password)@${VIRTUAL_IP_ADDRESS}:6446/superset" \
-    --connect-args {}; then
-  
   superset fab create-admin \
   --username "superset" \
   --firstname "superset" \