User-controlled git fields (customGitUrl, branch names, repo owner/name,
gitlab namespace, SSH hostname) were interpolated unescaped into git clone /
ssh-keyscan shell commands run via execAsync / execAsyncRemote, allowing
authenticated OS command injection. All such values are now passed through
shell-quote before interpolation (defense at the sink, covering every code
path including the compose branch bypass).
Closes GHSA-qxcw-cx35-2hrw, GHSA-hrfh-82jj-3q46, GHSA-6693-xv3f-69px,
GHSA-qwwm-hc7m-7xp9, GHSA-grrj-6xrh-j6vp, GHSA-x2p2-qq8g-2mqq,
GHSA-cg8g-x23v-5fw8
- Removed redundant helper functions for retrieving git configurations for applications and composes, streamlining the codebase.
- Updated the `ensurePatchRepo` function to directly handle repository cloning based on the application or compose type, improving clarity and maintainability.
- Refactored patch creation logic to eliminate unnecessary checks and streamline the process of creating patches.
- Enhanced the handling of output paths in repository cloning functions across different git providers, ensuring consistent behavior.
- Added support for Bitbucket email and workspace name in the authentication process.
- Updated the clone URL generation to use the correct format for API tokens.
- Improved error handling to ensure required fields are provided for both API tokens and app passwords.
- Added console logs for debugging clone URL and repository information during cloning.
Add option to disable recurse submodules under "Provider Select the source of your code" form.
* Add a checkbox to disable recurse submodules in `apps/dokploy/components/dashboard/application/general/generic/save-git-provider.tsx`, `apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx`, and `apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx`.
* Update the form schema in the above files to include the new option.
* Conditionally include the `--recurse-submodules` flag in the `git clone` command in the above files.
* Update the "Provider Select the source of your code" form in `apps/dokploy/components/dashboard/application/general/generic/show.tsx` to include the new option.
* Conditionally include the `--recurse-submodules` flag in the `git clone` command in `packages/server/src/utils/providers/bitbucket.ts`, `packages/server/src/utils/providers/git.ts`, `packages/server/src/utils/providers/github.ts`, and `packages/server/src/utils/providers/gitlab.ts`.
* Add the `--depth` flag to optimize submodule cloning performance in the `git clone` command in `packages/server/src/utils/providers/bitbucket.ts`, `packages/server/src/utils/providers/git.ts`, `packages/server/src/utils/providers/github.ts`, and `packages/server/src/utils/providers/gitlab.ts`.
---
For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/Dokploy/dokploy?shareId=XXXX-XXXX-XXXX-XXXX).
This commit focuses on removing unused variables, adding placeholder error handling, and generally tidying up various files across the Dokploy application. Changes include:
- Removing unused imports and variables
- Adding placeholder error handling in catch blocks
- Cleaning up commented-out code
- Removing deprecated utility files
- Improving type safety and code consistency
