Files
dokploy/packages/server
Mauricio Siu d629faebc6 fix(security): validate volumeName and escape volume-backup file names
Add VOLUME_NAME_REGEX (Docker volume-name format) and enforce it on volumeName in
create/update/runManually — a legit volume name never contains shell metacharacters,
so this blocks injection across every docker run/rm/rclone sink at once. Escape the
user-supplied backupFileName and the mount volumeName in database rebuild with quote().
2026-07-20 16:45:55 -06:00
..
2024-10-26 15:48:30 -06:00