Files
dokploy/apps
Mauricio Siu d629faebc6 fix(security): validate volumeName and escape volume-backup file names
Add VOLUME_NAME_REGEX (Docker volume-name format) and enforce it on volumeName in
create/update/runManually — a legit volume name never contains shell metacharacters,
so this blocks injection across every docker run/rm/rclone sink at once. Escape the
user-supplied backupFileName and the mount volumeName in database rebuild with quote().
2026-07-20 16:45:55 -06:00
..