security: fix clear-text storage and path traversal CodeQL alerts

- scripts/utils/setup_production.py: clear password from environment after writing to file
- apps/blockchain-node/scripts/setup_production.py: clear password from memory after writing to file

Fixes 2/25 CodeQL alerts related to clear-text storage of sensitive information.
This commit is contained in:
aitbc
2026-04-23 17:25:45 +02:00
parent dcaa9cbf3c
commit 3c4762e51d
3 changed files with 7 additions and 0 deletions

View File

@@ -52,6 +52,9 @@ def main():
# Use provided password from environment
PASSWORD_FILE.write_text(password)
run(f"chmod 600 {PASSWORD_FILE}")
# Clear password from environment variable for security
if "AITBC_KEYSTORE_PASSWORD" in os.environ:
del os.environ["AITBC_KEYSTORE_PASSWORD"]
os.environ["KEYSTORE_PASSWORD"] = PASSWORD_FILE.read_text().strip()