Merge branch 'canary' into feat/internal-path-routing

packages/server/src/db/schema/port.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { applications } from "./application";
 
 export const protocolType = pgEnum("protocolType", ["tcp", "udp"]);
+export const publishModeType = pgEnum("publishModeType", ["ingress", "host"]);
 
 export const ports = pgTable("port", {
 	portId: text("portId")
@@ -13,6 +14,7 @@ export const ports = pgTable("port", {
 		.primaryKey()
 		.$defaultFn(() => nanoid()),
 	publishedPort: integer("publishedPort").notNull(),
+	publishMode: publishModeType("publishMode").notNull().default("host"),
 	targetPort: integer("targetPort").notNull(),
 	protocol: protocolType("protocol").notNull(),
 
@@ -32,6 +34,7 @@ const createSchema = createInsertSchema(ports, {
 	portId: z.string().min(1),
 	applicationId: z.string().min(1),
 	publishedPort: z.number(),
+	publishMode: z.enum(["ingress", "host"]).default("ingress"),
 	targetPort: z.number(),
 	protocol: z.enum(["tcp", "udp"]).default("tcp"),
 });
@@ -39,6 +42,7 @@ const createSchema = createInsertSchema(ports, {
 export const apiCreatePort = createSchema
 	.pick({
 		publishedPort: true,
+		publishMode: true,
 		targetPort: true,
 		protocol: true,
 		applicationId: true,
@@ -55,6 +59,7 @@ export const apiUpdatePort = createSchema
 	.pick({
 		portId: true,
 		publishedPort: true,
+		publishMode: true,
 		targetPort: true,
 		protocol: true,
 	})

packages/server/src/db/schema/user.ts

@@ -15,6 +15,7 @@ import { backups } from "./backups";
 import { projects } from "./project";
 import { schedules } from "./schedule";
 import { certificateType } from "./shared";
+import { paths } from "@dokploy/server/constants";
 /**
  * This is an example of how to use the multi-project schema feature of Drizzle ORM. Use the same
  * database instance for multiple projects.
@@ -236,7 +237,31 @@ export const apiModifyTraefikConfig = z.object({
 	serverId: z.string().optional(),
 });
 export const apiReadTraefikConfig = z.object({
-	path: z.string().min(1),
+	path: z
+		.string()
+		.min(1)
+		.refine(
+			(path) => {
+				// Prevent directory traversal attacks
+				if (path.includes("../") || path.includes("..\\")) {
+					return false;
+				}
+
+				const { MAIN_TRAEFIK_PATH } = paths();
+				if (path.startsWith("/") && !path.startsWith(MAIN_TRAEFIK_PATH)) {
+					return false;
+				}
+				// Prevent null bytes and other dangerous characters
+				if (path.includes("\0") || path.includes("\x00")) {
+					return false;
+				}
+				return true;
+			},
+			{
+				message:
+					"Invalid path: path traversal or unauthorized directory access detected",
+			},
+		),
 	serverId: z.string().optional(),
 });