Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-22 14:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4875 from Dokploy/fix/cmdi-registry-test-login

Browse Source 
fix(security): command injection in registry.testRegistry / testRegistryById
This commit is contained in:
Mauricio Siu
2026-07-20 17:40:00 -06:00
committed by GitHub
parent d02f34f9d4 d3f522b7a6
commit ffe62bca0e
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
apps/dokploy/server/api/routers/registry.ts
View File

@@ -5,6 +5,7 @@ import {
findRegistryById, findRegistryById,
IS_CLOUD, IS_CLOUD,
removeRegistry, removeRegistry,
safeDockerLoginCommand,
updateRegistry, updateRegistry,
} from "@dokploy/server"; } from "@dokploy/server";
import { db } from "@dokploy/server/db"; import { db } from "@dokploy/server/db";
@@ -122,7 +123,11 @@ export const registryRouter = createTRPCRouter({
if (input.serverId && input.serverId !== "none") { if (input.serverId && input.serverId !== "none") {
await execAsyncRemote( await execAsyncRemote(
input.serverId, input.serverId,
`echo ${input.password} | docker ${args.join(" ")}`, safeDockerLoginCommand(
input.registryUrl,
input.username,
input.password,
),
); );
} else { } else {
await execFileAsync("docker", args, { await execFileAsync("docker", args, {
@@ -182,7 +187,11 @@ export const registryRouter = createTRPCRouter({
if (input.serverId && input.serverId !== "none") { if (input.serverId && input.serverId !== "none") {
await execAsyncRemote( await execAsyncRemote(
input.serverId, input.serverId,
`echo ${registryData.password} | docker ${args.join(" ")}`, safeDockerLoginCommand(
registryData.registryUrl,
registryData.username,
registryData.password,
),
); );
} else { } else {
await execFileAsync("docker", args, { await execFileAsync("docker", args, {