Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-22 14:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4860 from Dokploy/fix/cmdi-docker-build-pull

Browse Source 
fix(security): OS command injection in docker build/pull commands
This commit is contained in:
Mauricio Siu
2026-07-19 22:40:47 -06:00
committed by GitHub
parent 1c31ed9969 cba0b253c7
commit 0348f5fb38
4 changed files with 76 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/server/src/utils/builders/docker-file.ts
View File

@@ -85,9 +85,9 @@ export const getDockerCommand = (application: ApplicationNested) => {
}
command += `
echo "Building ${appName}" ;
cd ${dockerContextPath} || {
echo "❌ The path ${dockerContextPath} does not exist" ;
echo ${quote([`Building ${appName}`])} ;
cd ${quote([dockerContextPath])} || {
echo ${quote([`❌ The path ${dockerContextPath} does not exist`])} ;
exit 1;
}

7
packages/server/src/utils/builders/nixpacks.ts
View File

@@ -1,6 +1,7 @@
import path from "node:path";
import { getStaticCommand } from "@dokploy/server/utils/builders/static";
import { nanoid } from "nanoid";
import { quote } from "shell-quote";
import { prepareEnvironmentVariablesForShell } from "../docker/utils";
import { getBuildAppDirectory } from "../filesystem/directory";
import type { ApplicationNested } from ".";
@@ -52,10 +53,10 @@ export const getNixpacksCommand = (application: ApplicationNested) => {
bashCommand += `
docker create --name ${buildContainerId} ${appName}
mkdir -p ${localPath}
docker cp ${buildContainerId}:/app/${publishDirectory}${isDirectory ? "/." : ""} ${path.join(buildAppDirectory, publishDirectory)} || {
mkdir -p ${quote([localPath])}
docker cp ${quote([`${buildContainerId}:/app/${publishDirectory}${isDirectory ? "/." : ""}`])} ${quote([localPath])} || {
docker rm ${buildContainerId}
echo "❌ Copying ${publishDirectory} to ${path.join(buildAppDirectory, publishDirectory)} failed" ;
echo ${quote([`❌ Copying ${publishDirectory} to ${localPath} failed`])} ;
exit 1;
}
docker rm ${buildContainerId}

5
packages/server/src/utils/providers/docker.ts
View File

@@ -1,4 +1,5 @@
import { safeDockerLoginCommand } from "@dokploy/server/services/registry";
import { quote } from "shell-quote";
import type { ApplicationNested } from "../builders";
export const buildRemoteDocker = async (application: ApplicationNested) => {
@@ -9,7 +10,7 @@ export const buildRemoteDocker = async (application: ApplicationNested) => {
throw new Error("Docker image not found");
}
let command = `
echo "Pulling ${dockerImage}";
echo ${quote([`Pulling ${dockerImage}`])};
`;
if (username && password) {
@@ -22,7 +23,7 @@ fi
}
command += `
docker pull ${dockerImage} 2>&1 || {
docker pull ${quote([dockerImage])} 2>&1 || {
echo "❌ Pulling image failed";
exit 1;
}