Unsafe use of echo (may set empty password)

[maffe]

postgres/15/alpine/docker-entrypoint.sh

Line 91 in f8827c3

eval 'initdb --username="$POSTGRES_USER" --pwfile=<(echo "$POSTGRES_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'

If $POSTGRES_PASSWORD matches the regular expression ^-[neE]+$, the password will be set to an empty string because echo will interpret it as options. (Different shells allow different options for echo, scripts using echo with unknown/variable arguments are therefore not portable.)

printf %s "$POSTGRES_PASSWORD" should be used instead.

[maffe]

I’m not sure if it’s possible to authenticate using an empty password, but using the correct password will not work.

[tianon]

Nice! I don't think a password that starts with - and consists of nothing but some combination of n, e, and E is a particularly good idea, but the correct fix here is pretty simple. 😅