Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-22 22:35:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): redact git provider secrets from application.one response

Browse Source 
findApplicationById eagerly loads the github/gitlab/gitea/bitbucket relations
(needed server-side to clone) including OAuth tokens, the GitHub App private key
and webhook secret. application.one returned them to the client, exposing them to
any member with service:read even when hasGitProviderAccess was false.

Adds redactApplicationGitSecrets() in the application service (blanks the secret
columns, immutably) and applies it to application.one. No client feature reads
these secrets (verified in the frontend); server-side clone paths use
findApplicationById directly, so behaviour is unchanged.

Closes GHSA-hg9j-j5mc-phf5, GHSA-wx75-vxph-2m2f
This commit is contained in:
Mauricio Siu
2026-07-19 21:28:02 -06:00
parent c2c0e9c1c2
commit 68ea9f7771
3 changed files with 119 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
packages/server/src/services/application.ts
View File

@@ -122,6 +122,53 @@ export const findApplicationById = async (applicationId: string) => {
return application;
};
/**
* Blanks the git-provider secret columns nested inside an application before it
* is returned to a client. `findApplicationById` eagerly loads the github /
* gitlab / gitea / bitbucket relations (needed server-side to clone), but their
* OAuth tokens, app private key and webhook secret must never reach the browser:
* no client feature reads them, and `application.one` exposed them to any member
* with `service:read` even without git-provider access.
*/
export const redactApplicationGitSecrets = <
T extends {
github?: Record<string, unknown> | null;
gitlab?: Record<string, unknown> | null;
gitea?: Record<string, unknown> | null;
bitbucket?: Record<string, unknown> | null;
},
>(
application: T,
): T => {
const blank = (
provider: Record<string, unknown> | null | undefined,
fields: readonly string[],
) => {
if (!provider) return provider;
const redacted = { ...provider };
for (const field of fields) {
if (field in redacted) redacted[field] = "";
}
return redacted;
};
return {
...application,
github: blank(application.github, [
"githubClientSecret",
"githubPrivateKey",
"githubWebhookSecret",
]),
gitlab: blank(application.gitlab, ["secret", "accessToken", "refreshToken"]),
gitea: blank(application.gitea, [
"clientSecret",
"accessToken",
"refreshToken",
]),
bitbucket: blank(application.bitbucket, ["appPassword", "apiToken"]),
};
};
export const findApplicationByName = async (appName: string) => {
const application = await db.query.applications.findFirst({
where: eq(applications.appName, appName),