diff --git a/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts index 12e839567..f4f9d6c5d 100644 --- a/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts +++ b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts @@ -1,8 +1,10 @@ import { cloneGitRepository } from "@dokploy/server/utils/providers/git"; -import { shellWord } from "@dokploy/server/utils/providers/utils"; -import { parse } from "shell-quote"; +import { parse, quote } from "shell-quote"; import { describe, expect, it } from "vitest"; +// How git-provider commands escape a single user value before it reaches the shell. +const shellArg = (value: string) => quote([String(value ?? "")]); + // Payloads that, if reached a shell unescaped, would execute commands. const INJECTION_PAYLOADS = [ "$(touch /tmp/pwned)", @@ -24,10 +26,10 @@ const LEGIT_VALUES = [ "https://gitlab.example.com/group/sub/project.git", ]; -describe("shellWord (git provider shell escaping)", () => { +describe("git provider shell escaping (quote)", () => { it("collapses every injection payload into a single literal token (no shell operators)", () => { for (const payload of INJECTION_PAYLOADS) { - const parsed = parse(shellWord(payload)); + const parsed = parse(shellArg(payload)); // A safely escaped value parses back to exactly the original string, // as ONE token. If escaping failed, parse() would emit operator // objects such as { op: ";" } or { op: "$(" } instead. @@ -37,7 +39,7 @@ describe("shellWord (git provider shell escaping)", () => { it("leaves legitimate URLs and branch names intact", () => { for (const value of LEGIT_VALUES) { - expect(parse(shellWord(value))).toEqual([value]); + expect(parse(shellArg(value))).toEqual([value]); } }); }); diff --git a/packages/server/src/utils/providers/bitbucket.ts b/packages/server/src/utils/providers/bitbucket.ts index d0275d76e..ca4ac6c95 100644 --- a/packages/server/src/utils/providers/bitbucket.ts +++ b/packages/server/src/utils/providers/bitbucket.ts @@ -10,8 +10,8 @@ import { } from "@dokploy/server/services/bitbucket"; import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; +import { quote } from "shell-quote"; import type { z } from "zod"; -import { shellWord } from "./utils"; export type ApplicationWithBitbucket = InferResultType< "applications", @@ -125,8 +125,8 @@ export const cloneBitbucketRepository = async ({ const repoToUse = entity.bitbucketRepositorySlug || bitbucketRepository; const repoclone = `bitbucket.org/${bitbucketOwner}/${repoToUse}.git`; const cloneUrl = getBitbucketCloneUrl(bitbucket, repoclone); - command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`; - command += `git clone --branch ${shellWord(bitbucketBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; + command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`; + command += `git clone --branch ${quote([String(bitbucketBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/git.ts b/packages/server/src/utils/providers/git.ts index 07d6b0e1a..5ccbd6412 100644 --- a/packages/server/src/utils/providers/git.ts +++ b/packages/server/src/utils/providers/git.ts @@ -4,8 +4,8 @@ import { findSSHKeyById, updateSSHKeyById, } from "@dokploy/server/services/ssh-key"; +import { quote } from "shell-quote"; import { execAsync, execAsyncRemote } from "../process/execAsync"; -import { shellWord } from "./utils"; interface CloneGitRepository { appName: string; @@ -62,7 +62,7 @@ export const cloneGitRepository = async ({ } command += `rm -rf ${outputPath};`; command += `mkdir -p ${outputPath};`; - command += `echo ${shellWord(`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`)};`; + command += `echo ${quote([`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`])};`; if (customGitSSHKeyId) { await updateSSHKeyById({ @@ -79,8 +79,8 @@ export const cloneGitRepository = async ({ command += "chmod 600 /tmp/id_rsa;"; command += `export GIT_SSH_COMMAND="${gitSshCommand}";`; } - command += `if ! git clone --branch ${shellWord(customGitBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${shellWord(customGitUrl)} ${shellWord(outputPath)}; then - echo ${shellWord(`❌ [ERROR] Fail to clone the repository ${customGitUrl}`)}; + command += `if ! git clone --branch ${quote([String(customGitBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${quote([String(customGitUrl ?? "")])} ${quote([String(outputPath ?? "")])}; then + echo ${quote([`❌ [ERROR] Fail to clone the repository ${customGitUrl}`])}; exit 1; fi `; @@ -115,7 +115,7 @@ const addHostToKnownHostsCommand = (repositoryURL: string) => { // ssh-keyscan is best-effort: some Git hosts (e.g. Hugging Face) never answer // it, and its exit code must not abort the clone under `set -e`. The clone's // own host-key check (StrictHostKeyChecking=accept-new) is the real boundary. - return `ssh-keyscan -p ${Number(port)} ${shellWord(domain)} >> ${knownHostsPath} || true;`; + return `ssh-keyscan -p ${Number(port)} ${quote([String(domain ?? "")])} >> ${knownHostsPath} || true;`; }; const sanitizeRepoPathSSH = (input: string) => { const SSH_PATH_RE = new RegExp( diff --git a/packages/server/src/utils/providers/gitea.ts b/packages/server/src/utils/providers/gitea.ts index 5292a7a30..1c6ae3a83 100644 --- a/packages/server/src/utils/providers/gitea.ts +++ b/packages/server/src/utils/providers/gitea.ts @@ -7,7 +7,7 @@ import { } from "@dokploy/server/services/gitea"; import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; -import { shellWord } from "./utils"; +import { quote } from "shell-quote"; export const getErrorCloneRequirements = (entity: { giteaRepository?: string | null; @@ -177,8 +177,8 @@ export const cloneGiteaRepository = async ({ giteaRepository!, ); - command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`; - command += `git clone --branch ${shellWord(giteaBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; + command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`; + command += `git clone --branch ${quote([String(giteaBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/github.ts b/packages/server/src/utils/providers/github.ts index e004a8c62..bca0c259d 100644 --- a/packages/server/src/utils/providers/github.ts +++ b/packages/server/src/utils/providers/github.ts @@ -6,8 +6,8 @@ import type { InferResultType } from "@dokploy/server/types/with"; import { createAppAuth } from "@octokit/auth-app"; import { TRPCError } from "@trpc/server"; import { Octokit } from "octokit"; +import { quote } from "shell-quote"; import type { z } from "zod"; -import { shellWord } from "./utils"; export const authGithub = (githubProvider: Github): Octokit => { if (!haveGithubRequirements(githubProvider)) { @@ -167,8 +167,8 @@ export const cloneGithubRepository = async ({ command += `mkdir -p ${outputPath};`; const cloneUrl = `https://oauth2:${token}@${repoclone}`; - command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`; - command += `git clone --branch ${shellWord(branch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; + command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`; + command += `git clone --branch ${quote([String(branch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/gitlab.ts b/packages/server/src/utils/providers/gitlab.ts index 816979586..3907130ee 100644 --- a/packages/server/src/utils/providers/gitlab.ts +++ b/packages/server/src/utils/providers/gitlab.ts @@ -8,8 +8,8 @@ import { } from "@dokploy/server/services/gitlab"; import type { InferResultType } from "@dokploy/server/types/with"; import { TRPCError } from "@trpc/server"; +import { quote } from "shell-quote"; import type { z } from "zod"; -import { shellWord } from "./utils"; export const refreshGitlabToken = async (gitlabProviderId: string) => { const gitlabProvider = await findGitlabById(gitlabProviderId); @@ -152,8 +152,8 @@ export const cloneGitlabRepository = async ({ command += `mkdir -p ${outputPath};`; const repoClone = getGitlabRepoClone(gitlab, gitlabPathNamespace); const cloneUrl = getGitlabCloneUrl(gitlab, repoClone); - command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`; - command += `git clone --branch ${shellWord(gitlabBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`; + command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`; + command += `git clone --branch ${quote([String(gitlabBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`; return command; }; diff --git a/packages/server/src/utils/providers/utils.ts b/packages/server/src/utils/providers/utils.ts deleted file mode 100644 index ff82a6b11..000000000 --- a/packages/server/src/utils/providers/utils.ts +++ /dev/null @@ -1,10 +0,0 @@ -import { quote } from "shell-quote"; - -/** - * Escapes a single value so it can be safely interpolated as one argument into - * a `/bin/sh -c` command string (both local `execAsync` and remote SSH - * `execAsyncRemote`). User-controlled fields such as git URLs, branch names, - * repository owners and SSH hostnames must never reach a shell unescaped. - */ -export const shellWord = (value: string | number | null | undefined): string => - quote([String(value ?? "")]);