From 16b5b7293f9883327a89c69fcb6e5718767b064a Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Mon, 20 Jul 2026 16:48:43 -0600 Subject: [PATCH] fix(security): escape file paths and remote schedule command in shell invocations quote() the user-derived paths that reach the shell in file mounts (mount.ts, docker getCreateFileCommand), patch repo read (repoPath/filePath), certificate create/remove (certificatePath), and the remote scheduled command (containerId/shellType/command/logPath), so $(), backticks and traversal in these fields can no longer inject commands. --- packages/server/src/services/certificate.ts | 11 ++++++----- packages/server/src/services/mount.ts | 5 +++-- packages/server/src/services/patch-repo.ts | 5 +++-- packages/server/src/utils/docker/utils.ts | 6 +++--- packages/server/src/utils/schedules/utils.ts | 9 +++++---- 5 files changed, 20 insertions(+), 16 deletions(-) diff --git a/packages/server/src/services/certificate.ts b/packages/server/src/services/certificate.ts index aa5c3983c..1c6137506 100644 --- a/packages/server/src/services/certificate.ts +++ b/packages/server/src/services/certificate.ts @@ -9,6 +9,7 @@ import { import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory"; import { TRPCError } from "@trpc/server"; import { eq } from "drizzle-orm"; +import { quote } from "shell-quote"; import { stringify } from "yaml"; import type { z } from "zod"; import { encodeBase64 } from "../utils/docker/utils"; @@ -63,7 +64,7 @@ export const removeCertificateById = async (certificateId: string) => { const certDir = path.join(CERTIFICATES_PATH, certificate.certificatePath); if (certificate.serverId) { - await execAsyncRemote(certificate.serverId, `rm -rf ${certDir}`); + await execAsyncRemote(certificate.serverId, `rm -rf ${quote([certDir])}`); } else { await removeDirectoryIfExistsContent(certDir); } @@ -108,10 +109,10 @@ const createCertificateFiles = async (certificate: Certificate) => { const certificateData = encodeBase64(certificate.certificateData); const privateKey = encodeBase64(certificate.privateKey); const command = ` - mkdir -p ${certDir}; - echo "${certificateData}" | base64 -d > "${crtPath}"; - echo "${privateKey}" | base64 -d > "${keyPath}"; - echo "${yamlConfig}" > "${configFile}"; + mkdir -p ${quote([certDir])}; + echo "${certificateData}" | base64 -d > ${quote([crtPath])}; + echo "${privateKey}" | base64 -d > ${quote([keyPath])}; + echo "${yamlConfig}" > ${quote([configFile])}; `; await execAsyncRemote(certificate.serverId, command); diff --git a/packages/server/src/services/mount.ts b/packages/server/src/services/mount.ts index 1987ded27..e55075ad3 100644 --- a/packages/server/src/services/mount.ts +++ b/packages/server/src/services/mount.ts @@ -18,6 +18,7 @@ import { } from "@dokploy/server/utils/process/execAsync"; import { TRPCError } from "@trpc/server"; import { eq, type SQL, sql } from "drizzle-orm"; +import { quote } from "shell-quote"; import type { z } from "zod"; export type Mount = typeof mounts.$inferSelect; @@ -317,7 +318,7 @@ export const updateFileMount = async (mountId: string) => { try { const serverId = await getServerId(mount); const encodedContent = encodeBase64(mount.content || ""); - const command = `echo "${encodedContent}" | base64 -d > ${fullPath}`; + const command = `echo "${encodedContent}" | base64 -d > ${quote([fullPath])}`; if (serverId) { await execAsyncRemote(serverId, command); } else { @@ -337,7 +338,7 @@ export const deleteFileMount = async (mountId: string) => { try { const serverId = await getServerId(mount); if (serverId) { - const command = `rm -rf ${fullPath}`; + const command = `rm -rf ${quote([fullPath])}`; await execAsyncRemote(serverId, command); } else { await removeFileOrDirectory(fullPath); diff --git a/packages/server/src/services/patch-repo.ts b/packages/server/src/services/patch-repo.ts index 35e734533..f946d1dcd 100644 --- a/packages/server/src/services/patch-repo.ts +++ b/packages/server/src/services/patch-repo.ts @@ -1,6 +1,7 @@ import { join } from "node:path"; import { paths } from "@dokploy/server/constants"; import { TRPCError } from "@trpc/server"; +import { quote } from "shell-quote"; import { execAsync, execAsyncRemote } from "../utils/process/execAsync"; import { cloneBitbucketRepository } from "../utils/providers/bitbucket"; import { cloneGitRepository } from "../utils/providers/git"; @@ -85,7 +86,7 @@ export const readPatchRepoDirectory = async ( serverId?: string | null, ): Promise => { // Use git ls-tree to get tracked files only - const command = `cd "${repoPath}" && git ls-tree -r --name-only HEAD`; + const command = `cd ${quote([repoPath])} && git ls-tree -r --name-only HEAD`; let stdout: string; try { @@ -168,7 +169,7 @@ export const readPatchRepoFile = async ( const repoPath = join(PATCH_REPOS_PATH, type, application.appName); const fullPath = join(repoPath, filePath); - const command = `cat "${fullPath}"`; + const command = `cat ${quote([fullPath])}`; if (serverId) { const result = await execAsyncRemote(serverId, command); diff --git a/packages/server/src/utils/docker/utils.ts b/packages/server/src/utils/docker/utils.ts index 8065b7dd9..1aecb1d75 100644 --- a/packages/server/src/utils/docker/utils.ts +++ b/packages/server/src/utils/docker/utils.ts @@ -712,14 +712,14 @@ export const getCreateFileCommand = ( ) => { const fullPath = path.join(outputPath, filePath); if (fullPath.endsWith(path.sep) || filePath.endsWith("/")) { - return `mkdir -p ${fullPath};`; + return `mkdir -p ${quote([fullPath])};`; } const directory = path.dirname(fullPath); const encodedContent = encodeBase64(content); return ` - mkdir -p ${directory}; - echo "${encodedContent}" | base64 -d > "${fullPath}"; + mkdir -p ${quote([directory])}; + echo "${encodedContent}" | base64 -d > ${quote([fullPath])}; `; }; diff --git a/packages/server/src/utils/schedules/utils.ts b/packages/server/src/utils/schedules/utils.ts index 64657c9a6..8107839d8 100644 --- a/packages/server/src/utils/schedules/utils.ts +++ b/packages/server/src/utils/schedules/utils.ts @@ -9,6 +9,7 @@ import { } from "@dokploy/server/services/deployment"; import { findScheduleById } from "@dokploy/server/services/schedule"; import { scheduledJobs, scheduleJob as scheduleJobNode } from "node-schedule"; +import { quote } from "shell-quote"; import { getComposeContainer, getServiceContainer } from "../docker/utils"; import { execAsyncRemote } from "../process/execAsync"; import { spawnAsync } from "../process/spawnAsync"; @@ -77,12 +78,12 @@ export const runCommand = async (scheduleId: string) => { serverId, ` set -e - echo "Running command: docker exec ${containerId} ${shellType} -c '${command}'" >> ${deployment.logPath}; - docker exec ${containerId} ${shellType} -c '${command}' >> ${deployment.logPath} 2>> ${deployment.logPath} || { - echo "❌ Command failed" >> ${deployment.logPath}; + echo "Running scheduled command" >> ${quote([deployment.logPath])}; + docker exec ${quote([containerId])} ${quote([shellType])} -c ${quote([command])} >> ${quote([deployment.logPath])} 2>> ${quote([deployment.logPath])} || { + echo "❌ Command failed" >> ${quote([deployment.logPath])}; exit 1; } - echo "✅ Command executed successfully" >> ${deployment.logPath}; + echo "✅ Command executed successfully" >> ${quote([deployment.logPath])}; `, ); } catch (error) {