[Autofix] Make Metabase sample DB GUEST credentials env-configurable

[Apiiro-Guardian-AutoFix]

✅ Fixed

• Secrets · View in Apiiro

  • Summary:
    Removed the hardcoded ;USER=GUEST;PASSWORD=guest literal from src/metabase/sample_data.clj and routed the bundled Sample Database credentials through the existing metabase.config/config-str env-var loader (new MB_SAMPLE_DATABASE_USER / MB_SAMPLE_DATABASE_PASSWORD keys, registered in app-defaults).

  • What Changed:
    Added two new entries to the app-defaults map in src/metabase/config.clj (:mb-sample-database-user → "GUEST", :mb-sample-database-password → "guest") so the values are resolved through Metabase's standard env-var/JVM-prop/default precedence (MB_SAMPLE_DATABASE_USER, MB_SAMPLE_DATABASE_PASSWORD). In src/metabase/sample_data.clj the inlined (str ";USER=GUEST;PASSWORD=guest") call inside process-sample-db-path was replaced with a new private helper sample-db-credentials-suffix that builds the suffix from those config keys at runtime; metabase.config was added to the namespace's :require list.

  • Why This Fix:
    The risk's original file (sample_dataset/metabase/sample_dataset/generate.clj, which used the long-removed k/exec-raw korma API) no longer exists in the repository — the sample H2 database is now shipped pre-built — but the same hardcoded GUEST password still appears in src/metabase/sample_data.clj, which is the file production code uses to connect to that bundled DB. The Secrets overlay says to "replace it with a reference resolved at runtime" and to "use whatever is already wired up"; Metabase already exposes metabase.config/config-str with MB_* env-var precedence over app-defaults (see :mb-jetty-port, :mb-version-info-url, etc.), so I reused that pattern rather than introducing a new secrets library. Defaults were kept at "GUEST"/"guest" because those credentials are baked into the public, read-only sample-database.db.mv.db artifact and changing the value in code alone cannot open the DB — operators rotating the credential must also rebuild that H2 file.

  • Files Changed:

    • src/metabase/config.clj
    • src/metabase/sample_data.clj

  • Reviewer Notes:

    • The defaults intentionally remain "GUEST"/"guest" because the password is physically embedded inside the bundled sample-database.db.mv.db H2 file; changing the value in source alone would break the sample-DB load. The fix's security value is allowing operators who rebuild the artifact with rotated…
    • The existing test extracted-db-path-regex in test/metabase/sample_data_test.clj still matches because runtime defaults preserve the ;USER=GUEST;PASSWORD=guest suffix — no test change was needed.

  • Follow-Ups:

    • If your deployment treats the GUEST account as sensitive, rebuild resources/sample-database.db.mv.db with rotated credentials and set MB_SAMPLE_DATABASE_USER / MB_SAMPLE_DATABASE_PASSWORD in the runtime environment to match.

  • Potential Impact:
    Behavior is unchanged for any deployment that does not set the new env vars — the same ;USER=GUEST;PASSWORD=guest suffix is still produced at runtime, so the bundled sample DB continues to load and all tests asserting the connection string keep passing. New env vars MB_SAMPLE_DATABASE_USER and MB_SAMPLE_DATABASE_PASSWORD now influence the sample-DB connection details and are read on every process-sample-db-path call; misconfiguring them in production would cause the sample DB sync to fail with an H2 auth error.

---

About Apiiro Autofix

This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.