Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-24 07:15:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): escape S3/rclone args and restore paths to prevent command injection

Browse Source 
Wrap S3 credential flags (getS3Credentials + destination.testConnection), the
listBackupFiles search path, and every restore backupPath/backupFile with
shell-quote's quote() so $(), backticks, quotes and spaces in destination
fields or backupFile can no longer break out of the rclone shell commands.
This commit is contained in:
Mauricio Siu
2026-07-20 16:11:16 -06:00
parent 9b078e0b4c
commit eeb6e7b8ea
11 changed files with 34 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/server/src/utils/restore/postgres.ts
View File

@@ -1,6 +1,7 @@
import type { apiRestoreBackup } from "@dokploy/server/db/schema";
import type { Destination } from "@dokploy/server/services/destination";
import type { Postgres } from "@dokploy/server/services/postgres";
import { quote } from "shell-quote";
import type { z } from "zod";
import { getS3Credentials } from "../backups/utils";
import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -20,7 +21,7 @@ export const restorePostgresBackup = async (
const backupPath = `${bucketPath}/${backupInput.backupFile}`;
const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
const command = getRestoreCommand({
appName,