From 35c30a1210d06d296ca9685823b54f956301d6f7 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Mon, 20 Jul 2026 16:07:11 -0600 Subject: [PATCH] test: assert domain payload never parses as a shell operator (drop literal check) quote() legitimately wraps the payload text inside single quotes, so the raw substring is present but inert. leaksShellSyntax (via shell-quote parse) is the correct assertion; the literal not.toContain check was wrong. --- apps/dokploy/__test__/compose/domain-command-injection.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/dokploy/__test__/compose/domain-command-injection.test.ts b/apps/dokploy/__test__/compose/domain-command-injection.test.ts index a4132063d..24f129c58 100644 --- a/apps/dokploy/__test__/compose/domain-command-injection.test.ts +++ b/apps/dokploy/__test__/compose/domain-command-injection.test.ts @@ -50,8 +50,9 @@ describe("writeDomainsToCompose error path (GHSA-xmmr serviceName injection)", ( // The service does not exist in the compose, so we hit the error branch. expect(result).toContain("Has occurred an error"); + // The payload text may appear inside the single-quoted echo argument, but + // it must never parse as a shell operator ($(), backtick, ; …). expect(leaksShellSyntax(result, "touch")).toBe(false); - expect(result).not.toContain("$(touch"); }); it("neutralizes backtick and semicolon payloads too", async () => {