fix(security): stop user-supplied certificatePath in create schema

Same drizzle-zod $defaultFn-as-optional leak as schedule appName: certificatePath
(notNull + $defaultFn) was overridable, enabling path traversal out of the certs
dir even with the escaped shell paths. Omit it from apiCreateCertificate so it is
always server-generated (completes GHSA-q9qw).

packages/server/src/db/schema/certificate.ts

@@ -45,7 +45,7 @@ export const apiCreateCertificate = createInsertSchema(certificates, {
 	privateKey: z.string().min(1),
 	autoRenew: z.boolean().optional(),
 	serverId: z.string().optional(),
-});
+}).omit({ certificatePath: true });
 
 export const apiFindCertificate = z.object({
 	certificateId: z.string().min(1),

packages/server/src/db/schema/schedule.ts

@@ -81,7 +81,7 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 
 export const createScheduleSchema = createInsertSchema(schedules, {
 	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
-});
+}).omit({ appName: true });
 
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),

packages/server/src/services/schedule.ts

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { IS_CLOUD, paths } from "../constants";
 import { db } from "../db";
@@ -142,7 +143,7 @@ export const deleteSchedule = async (scheduleId: string) => {
 	const { SCHEDULES_PATH } = paths(!!serverId);
 
 	const fullPath = path.join(SCHEDULES_PATH, schedule?.appName || "");
-	const command = `rm -rf ${fullPath}`;
+	const command = `rm -rf ${quote([fullPath])}`;
 	if (serverId) {
 		await execAsyncRemote(serverId, command);
 	} else {
@@ -198,12 +199,13 @@ const handleScript = async (schedule: Schedule) => {
 ${schedule?.script || ""}`;
 
 	const encodedContent = encodeBase64(scriptWithPid);
+	const scriptPath = `${fullPath}/script.sh`;
 	const script = `
-	 	 mkdir -p ${fullPath}
+	 	 mkdir -p ${quote([fullPath])}
-	 	 rm -f ${fullPath}/script.sh
+	 	 rm -f ${quote([scriptPath])}
-		 touch ${fullPath}/script.sh
+		 touch ${quote([scriptPath])}
-		 chmod +x ${fullPath}/script.sh
+		 chmod +x ${quote([scriptPath])}
-		 echo "${encodedContent}" | base64 -d > ${fullPath}/script.sh
+		 echo "${encodedContent}" | base64 -d > ${quote([scriptPath])}
 	`;
 
 	if (schedule?.scheduleType === "dokploy-server") {