Merge pull request #3530 from Dokploy/fix/prevent-send-malicious-bash

feat(wss): add directory validation for WebSocket server log paths

apps/dokploy/server/wss/listen-deployment.ts

@@ -3,6 +3,7 @@ import type http from "node:http";
 import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
+import { readValidDirectory } from "./utils";
 
 export const setupDeploymentLogsWebSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
@@ -40,6 +41,11 @@ export const setupDeploymentLogsWebSocketServer = (
 			return;
 		}
 
+		if (!readValidDirectory(logPath)) {
+			ws.close(4000, "Invalid log path");
+			return;
+		}
+
 		if (!user || !session) {
 			ws.close();
 			return;

apps/dokploy/server/wss/utils.ts

@@ -32,6 +32,17 @@ export const isValidShell = (shell: string): boolean => {
 	return allowedShells.includes(shell);
 };
 
+export const readValidDirectory = (directory: string) => {
+	const { BASE_PATH } = paths();
+
+	const resolvedBase = path.resolve(BASE_PATH);
+	const resolvedDir = path.resolve(directory);
+
+	return (
+		resolvedDir === resolvedBase ||
+		resolvedDir.startsWith(resolvedBase + path.sep)
+	);
+};
 export const getShell = () => {
 	if (IS_CLOUD) {
 		return "NO_AVAILABLE";