From 47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Sun, 19 Jul 2026 20:32:15 -0600 Subject: [PATCH] fix(security): escape user input in git clone commands across all providers User-controlled git fields (customGitUrl, branch names, repo owner/name, gitlab namespace, SSH hostname) were interpolated unescaped into git clone / ssh-keyscan shell commands run via execAsync / execAsyncRemote, allowing authenticated OS command injection. All such values are now passed through shell-quote before interpolation (defense at the sink, covering every code path including the compose branch bypass). Closes GHSA-qxcw-cx35-2hrw, GHSA-hrfh-82jj-3q46, GHSA-6693-xv3f-69px, GHSA-qwwm-hc7m-7xp9, GHSA-grrj-6xrh-j6vp, GHSA-x2p2-qq8g-2mqq, GHSA-cg8g-x23v-5fw8 --- packages/server/src/utils/providers/bitbucket.ts | 5 +++-- packages/server/src/utils/providers/git.ts | 9 +++++---- packages/server/src/utils/providers/gitea.ts | 5 +++-- packages/server/src/utils/providers/github.ts | 5 +++-- packages/server/src/utils/providers/gitlab.ts | 5 +++-- packages/server/src/utils/providers/utils.ts | 10 ++++++++++ 6 files changed, 27 insertions(+), 12 deletions(-) create mode 100644 packages/server/src/utils/providers/utils.ts diff --git a/packages/server/src/utils/providers/bitbucket.ts b/packages/server/src/utils/providers/bitbucket.ts index d2be27a67..d0275d76e 100644 --- a/packages/server/src/utils/providers/bitbucket.ts +++ b/packages/server/src/utils/providers/bitbucket.ts @@ -11,6 +11,7 @@ import { import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; import type { z } from "zod"; +import { shellWord } from "./utils"; export type ApplicationWithBitbucket = InferResultType< "applications", @@ -124,8 +125,8 @@ export const cloneBitbucketRepository = async ({ const repoToUse = entity.bitbucketRepositorySlug || bitbucketRepository; const repoclone = `bitbucket.org/${bitbucketOwner}/${repoToUse}.git`; const cloneUrl = getBitbucketCloneUrl(bitbucket, repoclone); - command += `echo "Cloning Repo ${repoclone} to ${outputPath}: ✅";`; - command += `git clone --branch ${bitbucketBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(bitbucketBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/git.ts b/packages/server/src/utils/providers/git.ts index 8e7c71839..07d6b0e1a 100644 --- a/packages/server/src/utils/providers/git.ts +++ b/packages/server/src/utils/providers/git.ts @@ -5,6 +5,7 @@ import { updateSSHKeyById, } from "@dokploy/server/services/ssh-key"; import { execAsync, execAsyncRemote } from "../process/execAsync"; +import { shellWord } from "./utils"; interface CloneGitRepository { appName: string; @@ -61,7 +62,7 @@ export const cloneGitRepository = async ({ } command += `rm -rf ${outputPath};`; command += `mkdir -p ${outputPath};`; - command += `echo "Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅";`; + command += `echo ${shellWord(`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`)};`; if (customGitSSHKeyId) { await updateSSHKeyById({ @@ -78,8 +79,8 @@ export const cloneGitRepository = async ({ command += "chmod 600 /tmp/id_rsa;"; command += `export GIT_SSH_COMMAND="${gitSshCommand}";`; } - command += `if ! git clone --branch ${customGitBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${customGitUrl} ${outputPath}; then - echo "❌ [ERROR] Fail to clone the repository ${customGitUrl}"; + command += `if ! git clone --branch ${shellWord(customGitBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${shellWord(customGitUrl)} ${shellWord(outputPath)}; then + echo ${shellWord(`❌ [ERROR] Fail to clone the repository ${customGitUrl}`)}; exit 1; fi `; @@ -114,7 +115,7 @@ const addHostToKnownHostsCommand = (repositoryURL: string) => { // ssh-keyscan is best-effort: some Git hosts (e.g. Hugging Face) never answer // it, and its exit code must not abort the clone under `set -e`. The clone's // own host-key check (StrictHostKeyChecking=accept-new) is the real boundary. - return `ssh-keyscan -p ${port} ${domain} >> ${knownHostsPath} || true;`; + return `ssh-keyscan -p ${Number(port)} ${shellWord(domain)} >> ${knownHostsPath} || true;`; }; const sanitizeRepoPathSSH = (input: string) => { const SSH_PATH_RE = new RegExp( diff --git a/packages/server/src/utils/providers/gitea.ts b/packages/server/src/utils/providers/gitea.ts index 20c86a589..5292a7a30 100644 --- a/packages/server/src/utils/providers/gitea.ts +++ b/packages/server/src/utils/providers/gitea.ts @@ -7,6 +7,7 @@ import { } from "@dokploy/server/services/gitea"; import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; +import { shellWord } from "./utils"; export const getErrorCloneRequirements = (entity: { giteaRepository?: string | null; @@ -176,8 +177,8 @@ export const cloneGiteaRepository = async ({ giteaRepository!, ); - command += `echo "Cloning Repo ${repoClone} to ${outputPath}: ✅";`; - command += `git clone --branch ${giteaBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(giteaBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/github.ts b/packages/server/src/utils/providers/github.ts index 6309cf307..e004a8c62 100644 --- a/packages/server/src/utils/providers/github.ts +++ b/packages/server/src/utils/providers/github.ts @@ -7,6 +7,7 @@ import { createAppAuth } from "@octokit/auth-app"; import { TRPCError } from "@trpc/server"; import { Octokit } from "octokit"; import type { z } from "zod"; +import { shellWord } from "./utils"; export const authGithub = (githubProvider: Github): Octokit => { if (!haveGithubRequirements(githubProvider)) { @@ -166,8 +167,8 @@ export const cloneGithubRepository = async ({ command += `mkdir -p ${outputPath};`; const cloneUrl = `https://oauth2:${token}@${repoclone}`; - command += `echo "Cloning Repo ${repoclone} to ${outputPath}: ✅";`; - command += `git clone --branch ${branch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(branch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/gitlab.ts b/packages/server/src/utils/providers/gitlab.ts index 02121d346..816979586 100644 --- a/packages/server/src/utils/providers/gitlab.ts +++ b/packages/server/src/utils/providers/gitlab.ts @@ -9,6 +9,7 @@ import { import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; import type { z } from "zod"; +import { shellWord } from "./utils"; export const refreshGitlabToken = async (gitlabProviderId: string) => { const gitlabProvider = await findGitlabById(gitlabProviderId); @@ -151,8 +152,8 @@ export const cloneGitlabRepository = async ({ command += `mkdir -p ${outputPath};`; const repoClone = getGitlabRepoClone(gitlab, gitlabPathNamespace); const cloneUrl = getGitlabCloneUrl(gitlab, repoClone); - command += `echo "Cloning Repo ${repoClone} to ${outputPath}: ✅";`; - command += `git clone --branch ${gitlabBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(gitlabBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/utils.ts b/packages/server/src/utils/providers/utils.ts new file mode 100644 index 000000000..ff82a6b11 --- /dev/null +++ b/packages/server/src/utils/providers/utils.ts @@ -0,0 +1,10 @@ +import { quote } from "shell-quote"; + +/** + * Escapes a single value so it can be safely interpolated as one argument into + * a `/bin/sh -c` command string (both local `execAsync` and remote SSH + * `execAsyncRemote`). User-controlled fields such as git URLs, branch names, + * repository owners and SSH hostnames must never reach a shell unescaped. + */ +export const shellWord = (value: string | number | null | undefined): string => + quote([String(value ?? "")]);