Security of a self-updating web app

Question

What are the security concerns of the following scenario? (this is one of those crazy ideas that someone will try, and maybe a it's a good idea, and maybe it's a terrible idea...)

You have Rails app at example.com, and an action at https://example.com/admin/update_app

This action has the following requirements:

1. It requires https (and redirects if not on https)
2. It requires admin access
3. The action displays a page with a form that says "Repository password: [ ]"
4. This field is filtered out of the server logs, the same way that authentication to the site is filtered out, via the log filtering mechanism in Rails (i.e. this method)

This action does the following

1. You put your code repository password in the field and hit "Submit"
2. The action starts a shell script which pulls the latest updates from the stable branch of your code repository, and applies them to the site (unless repository authentication fails, in which case it stops all further steps)
3. The web server is restarted
4. An email is sent to the admin saying something simple like, "App update complete"

Answer 1

Don't send the password. The app could be compromised and trojaned or the filtering could fail. Instead, grant the web app read-only access to the repository via a separate account or public access.

Don't restart the server if there are no changes. Then the action is secure even without access control: unless the developer has authorized the update by updating the stable branch, nothing happens. If the stable branch is not so stable, create a separate production branch for this.

Stop the webserver before doing the update. The app might not be secure or safe to use as a mix of files from different versions.

Make sure the web server doesn't serve any metadata files left by the VCS.

Answer 2

Well, this all remind me re-invented capistrano deploy on server through git repository.

Only problem that: 1) what if it will be conflicts during merge(point 2)? 2) what if webserver will not restart correctly(point 3)? 3) What if branch in your repository is not so stable(point 2)?