mirror of
https://github.com/pi-hole/FTL.git
synced 2026-08-21 20:57:31 +01:00
bcambl
3966d6ba73
`pihole-FTL --config <key> <value>` puts the value in argv, which is visible via /proc/<pid>/cmdline and `ps -eo args=`. For secret values (notably the web password) this leaks to other unprivileged users for the lifetime of the child process. Allow reading the value from stdin by passing `-` in place of the value: `echo secret | pihole-FTL --config webserver.api.password -`. fgets reads up to 4095 bytes into a stack buffer, trailing CR/LF is stripped, and the existing set_config_from_CLI validation pipeline is reused unchanged. Buffer is bounded at 4096 bytes; values that fill the buffer without a terminating newline are rejected with a clear error rather than silently truncated. Signed-off-by: bcambl <5565939+bcambl@users.noreply.github.com>