andwati/dokploy
1
0
Fork 0
mirror of https://github.com/andwati/dokploy.git synced 2026-10-29 00:02:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): escape file paths and remote schedule command in shell invocations

Browse Source 
quote() the user-derived paths that reach the shell in file mounts
(mount.ts, docker getCreateFileCommand), patch repo read (repoPath/filePath),
certificate create/remove (certificatePath), and the remote scheduled command
(containerId/shellType/command/logPath), so $(), backticks and traversal in
these fields can no longer inject commands.
This commit is contained in:
Mauricio Siu
2026-07-20 16:48:43 -06:00
parent d629faebc6
commit 16b5b7293f
5 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/utils/docker/utils.ts
+3 -3
View File
@@ -712,14 +712,14 @@ export const getCreateFileCommand = (
) => {
const fullPath = path.join(outputPath, filePath);
if (fullPath.endsWith(path.sep) || filePath.endsWith("/")) {
return `mkdir -p ${fullPath};`;
return `mkdir -p ${quote([fullPath])};`;
}
const directory = path.dirname(fullPath);
const encodedContent = encodeBase64(content);
return `
mkdir -p ${directory};
echo "${encodedContent}" | base64 -d > "${fullPath}";
mkdir -p ${quote([directory])};
echo "${encodedContent}" | base64 -d > ${quote([fullPath])};
`;
};
packages/server/src/utils/schedules/utils.ts
+5 -4
View File
@@ -9,6 +9,7 @@ import {
} from "@dokploy/server/services/deployment";
import { findScheduleById } from "@dokploy/server/services/schedule";
import { scheduledJobs, scheduleJob as scheduleJobNode } from "node-schedule";
import { quote } from "shell-quote";
import { getComposeContainer, getServiceContainer } from "../docker/utils";
import { execAsyncRemote } from "../process/execAsync";
import { spawnAsync } from "../process/spawnAsync";
@@ -77,12 +78,12 @@ export const runCommand = async (scheduleId: string) => {
serverId,
`
set -e
echo "Running command: docker exec ${containerId} ${shellType} -c '${command}'" >> ${deployment.logPath};
docker exec ${containerId} ${shellType} -c '${command}' >> ${deployment.logPath} 2>> ${deployment.logPath} || {
echo "❌ Command failed" >> ${deployment.logPath};
echo "Running scheduled command" >> ${quote([deployment.logPath])};
docker exec ${quote([containerId])} ${quote([shellType])} -c ${quote([command])} >> ${quote([deployment.logPath])} 2>> ${quote([deployment.logPath])} || {
echo "❌ Command failed" >> ${quote([deployment.logPath])};
exit 1;
}
echo "✅ Command executed successfully" >> ${deployment.logPath};
echo "✅ Command executed successfully" >> ${quote([deployment.logPath])};
`,
);
} catch (error) {