Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-24 07:15:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): stop user-supplied certificatePath in create schema

Browse Source 
Same drizzle-zod $defaultFn-as-optional leak as schedule appName: certificatePath
(notNull + $defaultFn) was overridable, enabling path traversal out of the certs
dir even with the escaped shell paths. Omit it from apiCreateCertificate so it is
always server-generated (completes GHSA-q9qw).
This commit is contained in:
Mauricio Siu
2026-07-20 17:08:32 -06:00
parent 6943a395fe
commit fbf2ff73c2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/server/src/db/schema/certificate.ts
View File

@@ -45,7 +45,7 @@ export const apiCreateCertificate = createInsertSchema(certificates, {
privateKey: z.string().min(1), privateKey: z.string().min(1),
autoRenew: z.boolean().optional(), autoRenew: z.boolean().optional(),
serverId: z.string().optional(), serverId: z.string().optional(),
}); }).omit({ certificatePath: true });
export const apiFindCertificate = z.object({ export const apiFindCertificate = z.object({
certificateId: z.string().min(1), certificateId: z.string().min(1),