airbyte weak credentials

[secureness]

AI PRP: google/tsunami-security-scanner-plugins#445
Pull request: google/tsunami-security-scanner-plugins#537

[RaulDoyensec]

Hi @secureness,

Thank you for your contribution:

• I noticed that port 2375 is being exposed, which is the host’s Docker socket. This can potentially compromise the host.
• Additionally, there are many variables referenced in the docker-compose.yaml file that are not set, which makes the configuration non-functional.
• For the safe configuration, it would be helpful if you could also provide a working docker-compose file that avoids the need to install additional software manually.

Regards.

[RaulDoyensec]

Hi @secureness

I just wanted to follow up on the changes I suggested for your PR. Let me know if you have any questions or need further clarification.

Regards

[secureness]

@RaulDoyensec Hi, sorry I forgot about this PR, thanks for reminding me :))
I'm going to solve the issue today.

[secureness]

@RaulDoyensec Sadly the docker-compose setup is deprecated and it doesn't work anymore, I tried to patch the docker-compose configuration but it wasn't possible.
for now, I choose the easiest setup which we only need to download an executable in the current directory and also install the docker and minikube. this can be a most clean setup so far.