Merge branch 'canary' into 394-ability-to-backup-named-volume-to-s3

packages/server/src/db/schema/domain.ts

@@ -51,6 +51,8 @@ export const domains = pgTable("domain", {
 		{ onDelete: "cascade" },
 	),
 	certificateType: certificateType("certificateType").notNull().default("none"),
+	internalPath: text("internalPath").default("/"),
+	stripPath: boolean("stripPath").notNull().default(false),
 });
 
 export const domainsRelations = relations(domains, ({ one }) => ({
@@ -82,6 +84,8 @@ export const apiCreateDomain = createSchema.pick({
 	serviceName: true,
 	domainType: true,
 	previewDeploymentId: true,
+	internalPath: true,
+	stripPath: true,
 });
 
 export const apiFindDomain = createSchema
@@ -112,5 +116,7 @@ export const apiUpdateDomain = createSchema
 		customCertResolver: true,
 		serviceName: true,
 		domainType: true,
+		internalPath: true,
+		stripPath: true,
 	})
 	.merge(createSchema.pick({ domainId: true }).required());

packages/server/src/db/schema/user.ts

@@ -15,6 +15,7 @@ import { backups } from "./backups";
 import { projects } from "./project";
 import { schedules } from "./schedule";
 import { certificateType } from "./shared";
+import { paths } from "@dokploy/server/constants";
 /**
  * This is an example of how to use the multi-project schema feature of Drizzle ORM. Use the same
  * database instance for multiple projects.
@@ -236,7 +237,31 @@ export const apiModifyTraefikConfig = z.object({
 	serverId: z.string().optional(),
 });
 export const apiReadTraefikConfig = z.object({
-	path: z.string().min(1),
+	path: z
+		.string()
+		.min(1)
+		.refine(
+			(path) => {
+				// Prevent directory traversal attacks
+				if (path.includes("../") || path.includes("..\\")) {
+					return false;
+				}
+
+				const { MAIN_TRAEFIK_PATH } = paths();
+				if (path.startsWith("/") && !path.startsWith(MAIN_TRAEFIK_PATH)) {
+					return false;
+				}
+				// Prevent null bytes and other dangerous characters
+				if (path.includes("\0") || path.includes("\x00")) {
+					return false;
+				}
+				return true;
+			},
+			{
+				message:
+					"Invalid path: path traversal or unauthorized directory access detected",
+			},
+		),
 	serverId: z.string().optional(),
 });
 

packages/server/src/db/validations/domain.ts

@@ -4,6 +4,8 @@ export const domain = z
 	.object({
 		host: z.string().min(1, { message: "Add a hostname" }),
 		path: z.string().min(1).optional(),
+		internalPath: z.string().optional(),
+		stripPath: z.boolean().optional(),
 		port: z
 			.number()
 			.min(1, { message: "Port must be at least 1" })
@@ -29,12 +31,37 @@ export const domain = z
 				message: "Required when certificate type is custom",
 			});
 		}
+
+		// Validate stripPath requires a valid path
+		if (input.stripPath && (!input.path || input.path === "/")) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["stripPath"],
+				message:
+					"Strip path can only be enabled when a path other than '/' is specified",
+			});
+		}
+
+		// Validate internalPath starts with /
+		if (
+			input.internalPath &&
+			input.internalPath !== "/" &&
+			!input.internalPath.startsWith("/")
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["internalPath"],
+				message: "Internal path must start with '/'",
+			});
+		}
 	});
 
 export const domainCompose = z
 	.object({
 		host: z.string().min(1, { message: "Host is required" }),
 		path: z.string().min(1).optional(),
+		internalPath: z.string().optional(),
+		stripPath: z.boolean().optional(),
 		port: z
 			.number()
 			.min(1, { message: "Port must be at least 1" })
@@ -61,4 +88,27 @@ export const domainCompose = z
 				message: "Required when certificate type is custom",
 			});
 		}
+
+		// Validate stripPath requires a valid path
+		if (input.stripPath && (!input.path || input.path === "/")) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["stripPath"],
+				message:
+					"Strip path can only be enabled when a path other than '/' is specified",
+			});
+		}
+
+		// Validate internalPath starts with /
+		if (
+			input.internalPath &&
+			input.internalPath !== "/" &&
+			!input.internalPath.startsWith("/")
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["internalPath"],
+				message: "Internal path must start with '/'",
+			});
+		}
 	});