TheHive's Docker entrypoint logs the Play secret key at startup

[shane-lawrence]

TheHive logs the Play secret key at startup.

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	n/a
OS version (client)	n/a
TheHive version / git hash	3.4.0 / c44df9d
Package Type	Docker
Browser type & version	n/a

Problem Description

At startup, the Docker entrypoint prints the value of play.http.secret.key to stdout, which is commonly logged. This allows anyone with access to the logs to see the key. To practise proper secrets management, this value should not be logged.

Steps to Reproduce

1. docker run thehiveproject/thehive:3.4.0 -- --secret notverysecret

Possible Solutions

Don't log the secret.

Complementary information

Sample output:

❯ docker run thehiveproject/thehive:3.4.0-RC2 --secret notverysecret | head -100
Using secret: notverysecret
Warning automatic elasticsearch host config fails
elasticsearch host not configured
[info] o.r.Reflections - Reflections took 180 ms to scan 4 urls, producing 118 keys and 1297 values
[info] module - Loading model class connectors.cortex.models.ReportTemplateModel
[info] module - Loading model class models.TaskModel
...

[nadouani]

This one will be taken in a next patch