From 2e730c3e0c85667a82e96ef97b1b6ca25034e34c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Tue, 18 Aug 2026 16:14:21 +0200
Subject: [PATCH] fix(security): keep secrets out of the xtrace output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With DEBUG=true a single startup printed the admin and database passwords ten
times in clear text, because the install branch built its command as a string
that xtrace echoed fully expanded, and because `[[ -z "${VAR}" ]]` expands the
value it tests.

* build the maintenance:install arguments in a quoted array and append the
  credential options with xtrace disabled, restoring it afterwards. As a side
  effect a password containing a space or a glob character now works - the
  unquoted ${COMMAND} used to word-split it and abort the install.
* test the secret env defaults as "${VAR:+x}" so the trace shows "x" instead of
  the value (instance secret, database, admin, redis and SMTP passwords, object
  storage credentials, license key).
* stop tracing the occ argument list in /usr/bin/occ; the caller already traces
  its own "occ ..." line.

The passwords remain in the occ process argv, so `ps` inside the container and
admin_audit's command_executed entries can still see them. maintenance:install
has no env-var equivalent for --admin-pass, so that cannot be closed here.

Fixes #541

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
---
 CHANGELOG.md                                  |  4 ++++
 v22.04/overlay/etc/entrypoint.d/10-base.sh    |  3 ++-
 v22.04/overlay/etc/entrypoint.d/15-db.sh      |  3 ++-
 v22.04/overlay/etc/entrypoint.d/25-redis.sh   |  3 ++-
 v22.04/overlay/etc/entrypoint.d/30-admin.sh   |  3 ++-
 .../etc/entrypoint.d/40-objectstorage.sh      |  6 +++--
 v22.04/overlay/etc/entrypoint.d/65-license.sh |  3 ++-
 v22.04/overlay/etc/entrypoint.d/75-mail.sh    |  3 ++-
 v22.04/overlay/usr/bin/occ                    |  4 ++++
 v22.04/overlay/usr/bin/owncloud               | 24 +++++++++++--------
 v24.04/overlay/etc/entrypoint.d/10-base.sh    |  3 ++-
 v24.04/overlay/etc/entrypoint.d/15-db.sh      |  3 ++-
 v24.04/overlay/etc/entrypoint.d/25-redis.sh   |  3 ++-
 v24.04/overlay/etc/entrypoint.d/30-admin.sh   |  3 ++-
 .../etc/entrypoint.d/40-objectstorage.sh      |  6 +++--
 v24.04/overlay/etc/entrypoint.d/65-license.sh |  3 ++-
 v24.04/overlay/etc/entrypoint.d/75-mail.sh    |  3 ++-
 v24.04/overlay/usr/bin/occ                    |  4 ++++
 v24.04/overlay/usr/bin/owncloud               | 24 +++++++++++--------
 19 files changed, 72 insertions(+), 36 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9fec0b61..41c34b9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@
     one in `OWNCLOUD_APPS_INSTALL` no longer aborts the container startup. A
     failing marketplace install now logs why it failed
     [#539](https://github.com/owncloud-docker/base/issues/539)
+  * `DEBUG=true` no longer prints secrets (admin, database, redis and SMTP
+    passwords, instance secret, object storage credentials, license key), and a
+    password containing a space no longer breaks `maintenance:install`
+    [#541](https://github.com/owncloud-docker/base/issues/541)
 
 * Changed
   * Removed env variable `OWNCLOUD_MARKETPLACE_KEY` (and its
diff --git a/v22.04/overlay/etc/entrypoint.d/10-base.sh b/v22.04/overlay/etc/entrypoint.d/10-base.sh
index aa623dd8..55d18f63 100755
--- a/v22.04/overlay/etc/entrypoint.d/10-base.sh
+++ b/v22.04/overlay/etc/entrypoint.d/10-base.sh
@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DEBUG
 [[ -z "${OWNCLOUD_DEBUG}" ]] && OWNCLOUD_DEBUG=""
 
 declare -x OWNCLOUD_SECRET
-[[ -z "${OWNCLOUD_SECRET}" ]] && OWNCLOUD_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_SECRET:+x}" ]] && OWNCLOUD_SECRET=""
 
 declare -x OWNCLOUD_CIPHER
 [[ -z "${OWNCLOUD_CIPHER}" ]] && OWNCLOUD_CIPHER=""
diff --git a/v22.04/overlay/etc/entrypoint.d/15-db.sh b/v22.04/overlay/etc/entrypoint.d/15-db.sh
index 729f65c2..5352ee87 100755
--- a/v22.04/overlay/etc/entrypoint.d/15-db.sh
+++ b/v22.04/overlay/etc/entrypoint.d/15-db.sh
@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DB_USERNAME
 [[ -z "${OWNCLOUD_DB_USERNAME}" ]] && OWNCLOUD_DB_USERNAME=""
 
 declare -x OWNCLOUD_DB_PASSWORD
-[[ -z "${OWNCLOUD_DB_PASSWORD}" ]] && OWNCLOUD_DB_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_DB_PASSWORD:+x}" ]] && OWNCLOUD_DB_PASSWORD=""
 
 declare -x OWNCLOUD_DB_PREFIX
 [[ -z "${OWNCLOUD_DB_PREFIX}" ]] && OWNCLOUD_DB_PREFIX="oc_"
diff --git a/v22.04/overlay/etc/entrypoint.d/25-redis.sh b/v22.04/overlay/etc/entrypoint.d/25-redis.sh
index e0b74618..49712a8e 100755
--- a/v22.04/overlay/etc/entrypoint.d/25-redis.sh
+++ b/v22.04/overlay/etc/entrypoint.d/25-redis.sh
@@ -13,7 +13,8 @@ declare -x OWNCLOUD_REDIS_DB
 [[ -z "${OWNCLOUD_REDIS_DB}" ]] && OWNCLOUD_REDIS_DB=""
 
 declare -x OWNCLOUD_REDIS_PASSWORD
-[[ -z "${OWNCLOUD_REDIS_PASSWORD}" ]] && OWNCLOUD_REDIS_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_REDIS_PASSWORD:+x}" ]] && OWNCLOUD_REDIS_PASSWORD=""
 
 declare -x OWNCLOUD_REDIS_TIMEOUT
 [[ -z "${OWNCLOUD_REDIS_TIMEOUT}" ]] && OWNCLOUD_REDIS_TIMEOUT=""
diff --git a/v22.04/overlay/etc/entrypoint.d/30-admin.sh b/v22.04/overlay/etc/entrypoint.d/30-admin.sh
index b1db604c..eef49514 100755
--- a/v22.04/overlay/etc/entrypoint.d/30-admin.sh
+++ b/v22.04/overlay/etc/entrypoint.d/30-admin.sh
@@ -4,6 +4,7 @@ declare -x OWNCLOUD_ADMIN_USERNAME
 [[ -z "${OWNCLOUD_ADMIN_USERNAME}" ]] && OWNCLOUD_ADMIN_USERNAME="admin"
 
 declare -x OWNCLOUD_ADMIN_PASSWORD
-[[ -z "${OWNCLOUD_ADMIN_PASSWORD}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_ADMIN_PASSWORD:+x}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
 
 true
diff --git a/v22.04/overlay/etc/entrypoint.d/40-objectstorage.sh b/v22.04/overlay/etc/entrypoint.d/40-objectstorage.sh
index d8e8d9f1..f536cda3 100755
--- a/v22.04/overlay/etc/entrypoint.d/40-objectstorage.sh
+++ b/v22.04/overlay/etc/entrypoint.d/40-objectstorage.sh
@@ -16,10 +16,12 @@ declare -x OWNCLOUD_OBJECTSTORE_REGION
 [[ -z "${OWNCLOUD_OBJECTSTORE_REGION}" ]] && OWNCLOUD_OBJECTSTORE_REGION="us-east-1"
 
 declare -x OWNCLOUD_OBJECTSTORE_KEY
-[[ -z "${OWNCLOUD_OBJECTSTORE_KEY}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_KEY:+x}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
 
 declare -x OWNCLOUD_OBJECTSTORE_SECRET
-[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET:+x}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
 
 declare -x OWNCLOUD_OBJECTSTORE_ENDPOINT
 [[ -z "${OWNCLOUD_OBJECTSTORE_ENDPOINT}" ]] && OWNCLOUD_OBJECTSTORE_ENDPOINT="https://s3.${OWNCLOUD_OBJECTSTORE_REGION}.amazonaws.com"
diff --git a/v22.04/overlay/etc/entrypoint.d/65-license.sh b/v22.04/overlay/etc/entrypoint.d/65-license.sh
index 7df5b4a0..97d0a1df 100755
--- a/v22.04/overlay/etc/entrypoint.d/65-license.sh
+++ b/v22.04/overlay/etc/entrypoint.d/65-license.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 
 declare -x OWNCLOUD_LICENSE_KEY
-[[ -z "${OWNCLOUD_LICENSE_KEY}" ]] && OWNCLOUD_LICENSE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_LICENSE_KEY:+x}" ]] && OWNCLOUD_LICENSE_KEY=""
 
 declare -x OWNCLOUD_LICENSE_CLASS
 [[ -z "${OWNCLOUD_LICENSE_CLASS}" ]] && OWNCLOUD_LICENSE_CLASS=""
diff --git a/v22.04/overlay/etc/entrypoint.d/75-mail.sh b/v22.04/overlay/etc/entrypoint.d/75-mail.sh
index fd4b94b9..f9a044af 100755
--- a/v22.04/overlay/etc/entrypoint.d/75-mail.sh
+++ b/v22.04/overlay/etc/entrypoint.d/75-mail.sh
@@ -34,6 +34,7 @@ declare -x OWNCLOUD_MAIL_SMTP_NAME
 [[ -z "${OWNCLOUD_MAIL_SMTP_NAME}" ]] && OWNCLOUD_MAIL_SMTP_NAME=""
 
 declare -x OWNCLOUD_MAIL_SMTP_PASSWORD
-[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD:+x}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
 
 true
diff --git a/v22.04/overlay/usr/bin/occ b/v22.04/overlay/usr/bin/occ
index 8d921046..362cf18e 100755
--- a/v22.04/overlay/usr/bin/occ
+++ b/v22.04/overlay/usr/bin/occ
@@ -9,6 +9,10 @@ if [[ -z "${OWNCLOUD_ENTRYPOINT_INITIALIZED}" ]]; then
   done
 fi
 
+# the argument list can carry credentials, e.g. "maintenance:install --admin-pass",
+# so it must not be echoed by xtrace. The caller already traces its own "occ ..." line.
+{ set +x; } 2>/dev/null
+
 if [[ "$(id -u)" == "0" ]]; then
   setpriv --reuid=www-data --regid=www-data --init-groups php /var/www/owncloud/occ "$@"
 else
diff --git a/v22.04/overlay/usr/bin/owncloud b/v22.04/overlay/usr/bin/owncloud
index e0247034..5872847a 100755
--- a/v22.04/overlay/usr/bin/owncloud
+++ b/v22.04/overlay/usr/bin/owncloud
@@ -11,20 +11,24 @@ fi
 
 case ${1} in
 install)
-  COMMAND="occ maintenance:install --no-interaction --data-dir ${OWNCLOUD_VOLUME_FILES}"
-  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && COMMAND="${COMMAND} --database ${OWNCLOUD_DB_TYPE}"
-  [[ -n "${OWNCLOUD_DB_NAME}" ]] && COMMAND="${COMMAND} --database-name ${OWNCLOUD_DB_NAME}"
-  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && COMMAND="${COMMAND} --database-user ${OWNCLOUD_DB_USERNAME}"
-  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && COMMAND="${COMMAND} --database-pass ${OWNCLOUD_DB_PASSWORD}"
-  [[ -n "${OWNCLOUD_DB_HOST}" ]] && COMMAND="${COMMAND} --database-host ${OWNCLOUD_DB_HOST}"
-  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && COMMAND="${COMMAND} --database-table-prefix ${OWNCLOUD_DB_PREFIX}"
-  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && COMMAND="${COMMAND} --admin-user ${OWNCLOUD_ADMIN_USERNAME}"
-  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && COMMAND="${COMMAND} --admin-pass ${OWNCLOUD_ADMIN_PASSWORD}"
+  ARGS=(maintenance:install --no-interaction --data-dir "${OWNCLOUD_VOLUME_FILES}")
+  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && ARGS+=(--database "${OWNCLOUD_DB_TYPE}")
+  [[ -n "${OWNCLOUD_DB_NAME}" ]] && ARGS+=(--database-name "${OWNCLOUD_DB_NAME}")
+  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && ARGS+=(--database-user "${OWNCLOUD_DB_USERNAME}")
+  [[ -n "${OWNCLOUD_DB_HOST}" ]] && ARGS+=(--database-host "${OWNCLOUD_DB_HOST}")
+  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && ARGS+=(--database-table-prefix "${OWNCLOUD_DB_PREFIX}")
+  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && ARGS+=(--admin-user "${OWNCLOUD_ADMIN_USERNAME}")
+
+  # keep the credentials out of the xtrace output when DEBUG=true
+  { set +x; } 2>/dev/null
+  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && ARGS+=(--database-pass "${OWNCLOUD_DB_PASSWORD}")
+  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && ARGS+=(--admin-pass "${OWNCLOUD_ADMIN_PASSWORD}")
 
   set +e
-  ${COMMAND}
+  occ "${ARGS[@]}"
   RES=$?
   set -e
+  [[ "${DEBUG}" == "true" ]] && set -x
 
   if [[ "${RES}" -ge "1" ]]; then
     exit ${RES}
diff --git a/v24.04/overlay/etc/entrypoint.d/10-base.sh b/v24.04/overlay/etc/entrypoint.d/10-base.sh
index aa623dd8..55d18f63 100755
--- a/v24.04/overlay/etc/entrypoint.d/10-base.sh
+++ b/v24.04/overlay/etc/entrypoint.d/10-base.sh
@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DEBUG
 [[ -z "${OWNCLOUD_DEBUG}" ]] && OWNCLOUD_DEBUG=""
 
 declare -x OWNCLOUD_SECRET
-[[ -z "${OWNCLOUD_SECRET}" ]] && OWNCLOUD_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_SECRET:+x}" ]] && OWNCLOUD_SECRET=""
 
 declare -x OWNCLOUD_CIPHER
 [[ -z "${OWNCLOUD_CIPHER}" ]] && OWNCLOUD_CIPHER=""
diff --git a/v24.04/overlay/etc/entrypoint.d/15-db.sh b/v24.04/overlay/etc/entrypoint.d/15-db.sh
index 729f65c2..5352ee87 100755
--- a/v24.04/overlay/etc/entrypoint.d/15-db.sh
+++ b/v24.04/overlay/etc/entrypoint.d/15-db.sh
@@ -13,7 +13,8 @@ declare -x OWNCLOUD_DB_USERNAME
 [[ -z "${OWNCLOUD_DB_USERNAME}" ]] && OWNCLOUD_DB_USERNAME=""
 
 declare -x OWNCLOUD_DB_PASSWORD
-[[ -z "${OWNCLOUD_DB_PASSWORD}" ]] && OWNCLOUD_DB_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_DB_PASSWORD:+x}" ]] && OWNCLOUD_DB_PASSWORD=""
 
 declare -x OWNCLOUD_DB_PREFIX
 [[ -z "${OWNCLOUD_DB_PREFIX}" ]] && OWNCLOUD_DB_PREFIX="oc_"
diff --git a/v24.04/overlay/etc/entrypoint.d/25-redis.sh b/v24.04/overlay/etc/entrypoint.d/25-redis.sh
index ebc33421..bafb3fa1 100755
--- a/v24.04/overlay/etc/entrypoint.d/25-redis.sh
+++ b/v24.04/overlay/etc/entrypoint.d/25-redis.sh
@@ -13,7 +13,8 @@ declare -x OWNCLOUD_REDIS_DB
 [[ -z "${OWNCLOUD_REDIS_DB}" ]] && OWNCLOUD_REDIS_DB=""
 
 declare -x OWNCLOUD_REDIS_PASSWORD
-[[ -z "${OWNCLOUD_REDIS_PASSWORD}" ]] && OWNCLOUD_REDIS_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_REDIS_PASSWORD:+x}" ]] && OWNCLOUD_REDIS_PASSWORD=""
 
 declare -x OWNCLOUD_REDIS_TIMEOUT
 [[ -z "${OWNCLOUD_REDIS_TIMEOUT}" ]] && OWNCLOUD_REDIS_TIMEOUT=""
diff --git a/v24.04/overlay/etc/entrypoint.d/30-admin.sh b/v24.04/overlay/etc/entrypoint.d/30-admin.sh
index b1db604c..eef49514 100755
--- a/v24.04/overlay/etc/entrypoint.d/30-admin.sh
+++ b/v24.04/overlay/etc/entrypoint.d/30-admin.sh
@@ -4,6 +4,7 @@ declare -x OWNCLOUD_ADMIN_USERNAME
 [[ -z "${OWNCLOUD_ADMIN_USERNAME}" ]] && OWNCLOUD_ADMIN_USERNAME="admin"
 
 declare -x OWNCLOUD_ADMIN_PASSWORD
-[[ -z "${OWNCLOUD_ADMIN_PASSWORD}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_ADMIN_PASSWORD:+x}" ]] && OWNCLOUD_ADMIN_PASSWORD="admin"
 
 true
diff --git a/v24.04/overlay/etc/entrypoint.d/40-objectstorage.sh b/v24.04/overlay/etc/entrypoint.d/40-objectstorage.sh
index d8e8d9f1..f536cda3 100755
--- a/v24.04/overlay/etc/entrypoint.d/40-objectstorage.sh
+++ b/v24.04/overlay/etc/entrypoint.d/40-objectstorage.sh
@@ -16,10 +16,12 @@ declare -x OWNCLOUD_OBJECTSTORE_REGION
 [[ -z "${OWNCLOUD_OBJECTSTORE_REGION}" ]] && OWNCLOUD_OBJECTSTORE_REGION="us-east-1"
 
 declare -x OWNCLOUD_OBJECTSTORE_KEY
-[[ -z "${OWNCLOUD_OBJECTSTORE_KEY}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_KEY:+x}" ]] && OWNCLOUD_OBJECTSTORE_KEY=""
 
 declare -x OWNCLOUD_OBJECTSTORE_SECRET
-[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_OBJECTSTORE_SECRET:+x}" ]] && OWNCLOUD_OBJECTSTORE_SECRET=""
 
 declare -x OWNCLOUD_OBJECTSTORE_ENDPOINT
 [[ -z "${OWNCLOUD_OBJECTSTORE_ENDPOINT}" ]] && OWNCLOUD_OBJECTSTORE_ENDPOINT="https://s3.${OWNCLOUD_OBJECTSTORE_REGION}.amazonaws.com"
diff --git a/v24.04/overlay/etc/entrypoint.d/65-license.sh b/v24.04/overlay/etc/entrypoint.d/65-license.sh
index 7df5b4a0..97d0a1df 100755
--- a/v24.04/overlay/etc/entrypoint.d/65-license.sh
+++ b/v24.04/overlay/etc/entrypoint.d/65-license.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 
 declare -x OWNCLOUD_LICENSE_KEY
-[[ -z "${OWNCLOUD_LICENSE_KEY}" ]] && OWNCLOUD_LICENSE_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_LICENSE_KEY:+x}" ]] && OWNCLOUD_LICENSE_KEY=""
 
 declare -x OWNCLOUD_LICENSE_CLASS
 [[ -z "${OWNCLOUD_LICENSE_CLASS}" ]] && OWNCLOUD_LICENSE_CLASS=""
diff --git a/v24.04/overlay/etc/entrypoint.d/75-mail.sh b/v24.04/overlay/etc/entrypoint.d/75-mail.sh
index fd4b94b9..f9a044af 100755
--- a/v24.04/overlay/etc/entrypoint.d/75-mail.sh
+++ b/v24.04/overlay/etc/entrypoint.d/75-mail.sh
@@ -34,6 +34,7 @@ declare -x OWNCLOUD_MAIL_SMTP_NAME
 [[ -z "${OWNCLOUD_MAIL_SMTP_NAME}" ]] && OWNCLOUD_MAIL_SMTP_NAME=""
 
 declare -x OWNCLOUD_MAIL_SMTP_PASSWORD
-[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_MAIL_SMTP_PASSWORD:+x}" ]] && OWNCLOUD_MAIL_SMTP_PASSWORD=""
 
 true
diff --git a/v24.04/overlay/usr/bin/occ b/v24.04/overlay/usr/bin/occ
index 8d921046..362cf18e 100755
--- a/v24.04/overlay/usr/bin/occ
+++ b/v24.04/overlay/usr/bin/occ
@@ -9,6 +9,10 @@ if [[ -z "${OWNCLOUD_ENTRYPOINT_INITIALIZED}" ]]; then
   done
 fi
 
+# the argument list can carry credentials, e.g. "maintenance:install --admin-pass",
+# so it must not be echoed by xtrace. The caller already traces its own "occ ..." line.
+{ set +x; } 2>/dev/null
+
 if [[ "$(id -u)" == "0" ]]; then
   setpriv --reuid=www-data --regid=www-data --init-groups php /var/www/owncloud/occ "$@"
 else
diff --git a/v24.04/overlay/usr/bin/owncloud b/v24.04/overlay/usr/bin/owncloud
index f12eba59..de7e0c9c 100755
--- a/v24.04/overlay/usr/bin/owncloud
+++ b/v24.04/overlay/usr/bin/owncloud
@@ -11,20 +11,24 @@ fi
 
 case ${1} in
 install)
-  COMMAND="occ maintenance:install --no-interaction --data-dir ${OWNCLOUD_VOLUME_FILES}"
-  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && COMMAND="${COMMAND} --database ${OWNCLOUD_DB_TYPE}"
-  [[ -n "${OWNCLOUD_DB_NAME}" ]] && COMMAND="${COMMAND} --database-name ${OWNCLOUD_DB_NAME}"
-  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && COMMAND="${COMMAND} --database-user ${OWNCLOUD_DB_USERNAME}"
-  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && COMMAND="${COMMAND} --database-pass ${OWNCLOUD_DB_PASSWORD}"
-  [[ -n "${OWNCLOUD_DB_HOST}" ]] && COMMAND="${COMMAND} --database-host ${OWNCLOUD_DB_HOST}"
-  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && COMMAND="${COMMAND} --database-table-prefix ${OWNCLOUD_DB_PREFIX}"
-  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && COMMAND="${COMMAND} --admin-user ${OWNCLOUD_ADMIN_USERNAME}"
-  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && COMMAND="${COMMAND} --admin-pass ${OWNCLOUD_ADMIN_PASSWORD}"
+  ARGS=(maintenance:install --no-interaction --data-dir "${OWNCLOUD_VOLUME_FILES}")
+  [[ -n "${OWNCLOUD_DB_TYPE}" ]] && ARGS+=(--database "${OWNCLOUD_DB_TYPE}")
+  [[ -n "${OWNCLOUD_DB_NAME}" ]] && ARGS+=(--database-name "${OWNCLOUD_DB_NAME}")
+  [[ -n "${OWNCLOUD_DB_USERNAME}" ]] && ARGS+=(--database-user "${OWNCLOUD_DB_USERNAME}")
+  [[ -n "${OWNCLOUD_DB_HOST}" ]] && ARGS+=(--database-host "${OWNCLOUD_DB_HOST}")
+  [[ -n "${OWNCLOUD_DB_PREFIX}" ]] && ARGS+=(--database-table-prefix "${OWNCLOUD_DB_PREFIX}")
+  [[ -n "${OWNCLOUD_ADMIN_USERNAME}" ]] && ARGS+=(--admin-user "${OWNCLOUD_ADMIN_USERNAME}")
+
+  # keep the credentials out of the xtrace output when DEBUG=true
+  { set +x; } 2>/dev/null
+  [[ -n "${OWNCLOUD_DB_PASSWORD}" ]] && ARGS+=(--database-pass "${OWNCLOUD_DB_PASSWORD}")
+  [[ -n "${OWNCLOUD_ADMIN_PASSWORD}" ]] && ARGS+=(--admin-pass "${OWNCLOUD_ADMIN_PASSWORD}")
 
   set +e
-  ${COMMAND}
+  occ "${ARGS[@]}"
   RES=$?
   set -e
+  [[ "${DEBUG}" == "true" ]] && set -x
 
   if [[ "${RES}" -ge "1" ]]; then
     exit ${RES}