Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-22 14:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): escape file paths and remote schedule command in shell invocations

Browse Source 
quote() the user-derived paths that reach the shell in file mounts
(mount.ts, docker getCreateFileCommand), patch repo read (repoPath/filePath),
certificate create/remove (certificatePath), and the remote scheduled command
(containerId/shellType/command/logPath), so $(), backticks and traversal in
these fields can no longer inject commands.
This commit is contained in:
Mauricio Siu
2026-07-20 16:48:43 -06:00
parent d629faebc6
commit 16b5b7293f
5 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/server/src/utils/docker/utils.ts
View File

@@ -712,14 +712,14 @@ export const getCreateFileCommand = (
) => {
const fullPath = path.join(outputPath, filePath);
if (fullPath.endsWith(path.sep) || filePath.endsWith("/")) {
return `mkdir -p ${fullPath};`;
return `mkdir -p ${quote([fullPath])};`;
}
const directory = path.dirname(fullPath);
const encodedContent = encodeBase64(content);
return `
mkdir -p ${directory};
echo "${encodedContent}" | base64 -d > "${fullPath}";
mkdir -p ${quote([directory])};
echo "${encodedContent}" | base64 -d > ${quote([fullPath])};
`;
};