From 1eec714d4acd68dad6a437618d9f60695a6d42e6 Mon Sep 17 00:00:00 2001
From: HomeOS Bootstrap <homeos@localhost>
Date: Fri, 17 Jul 2026 22:54:03 +0200
Subject: [PATCH] Fix R15: pass MQTT passwords to the broker without shell
 interpolation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gen-passwd.sh embedded passwords in `sh -c "..."`, which breaks or injects for
strong passwords containing quotes/$/;. Export them and forward with bare
`-e NAME`, reading them as env vars inside a single-quoted container script — any
character is now handled safely.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docker/mosquitto/gen-passwd.sh | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/docker/mosquitto/gen-passwd.sh b/docker/mosquitto/gen-passwd.sh
index aef4cd7..a373e14 100755
--- a/docker/mosquitto/gen-passwd.sh
+++ b/docker/mosquitto/gen-passwd.sh
@@ -24,11 +24,18 @@ LPASS="$(ensure_pw MQTT_AUTH_PASSWORD)"
 SPASS="$(ensure_pw MQTT_SHELLY_PASSWORD)"
 DPASS="$(ensure_pw MQTT_SIDECAR_PASSWORD)"
 
-docker run --rm -v "$(pwd)/docker/mosquitto/config:/cfg" eclipse-mosquitto:2 sh -c "
-    rm -f /cfg/passwd
-    mosquitto_passwd -c -b /cfg/passwd laravel '${LPASS}'
-    mosquitto_passwd -b /cfg/passwd shelly  '${SPASS}'
-    mosquitto_passwd -b /cfg/passwd sidecar '${DPASS}'
-    chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
-"
+# Export + forward with bare `-e NAME` so docker passes the values verbatim (no host
+# interpolation). Read inside the container (single-quoted body) as env vars, so any
+# character in a password — quotes, $, ;, backticks — is handled safely.
+export LPASS SPASS DPASS
+
+docker run --rm -e LPASS -e SPASS -e DPASS \
+    -v "$(pwd)/docker/mosquitto/config:/cfg" \
+    eclipse-mosquitto:2 sh -c '
+        rm -f /cfg/passwd
+        mosquitto_passwd -c -b /cfg/passwd laravel "$LPASS"
+        mosquitto_passwd -b /cfg/passwd shelly  "$SPASS"
+        mosquitto_passwd -b /cfg/passwd sidecar "$DPASS"
+        chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
+    '
 echo 'Mosquitto passwd generated (users: laravel, shelly, sidecar).'