andwati/dokploy
1
0
Fork 0
mirror of https://github.com/andwati/dokploy.git synced 2026-11-09 13:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow docker compose command chaining

Browse Source
This commit is contained in:
ews-pgasser
2026-08-06 15:25:04 +02:00
parent 53feb9dd5b
commit ac57e22b87
1 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/utils/builders/compose.ts
+19 -2
View File
@@ -70,7 +70,8 @@ Compose Type: ${composeType} ✅`;
// Shell control characters that must never appear in a user-provided compose // Shell control characters that must never appear in a user-provided compose
// command: they would let it break out of the `docker ${command}` invocation // command: they would let it break out of the `docker ${command}` invocation
// into arbitrary host commands. A normal docker compose CLI line never needs them. // into arbitrary host commands. A normal docker compose CLI line never needs them.
const UNSAFE_COMPOSE_COMMAND = /[;&|`$(){}<>\n\\]/; // Removed '&' from the blocklist to allow '&&' chaining
const UNSAFE_COMPOSE_COMMAND = /[;|`$(){}<>\n\\]/;
const sanitizeCommand = (command: string) => { const sanitizeCommand = (command: string) => {
const sanitizedCommand = command.trim(); const sanitizedCommand = command.trim();
@@ -81,8 +82,24 @@ const sanitizeCommand = (command: string) => {
); );
} }
const parts = sanitizedCommand.split(/\s+/); if (sanitizedCommand.includes("&")) {
// Block single '&' (e.g., backgrounding tasks) or malformed chains like '&&&'
if (/(?<!&)&(?!&)/.test(sanitizedCommand) || sanitizedCommand.includes("&&&")) {
throw new Error("Single '&' is not allowed. Use '&&' for chaining.");
}
// Split by '&&' and check that every chained command (skipping the first one) is safe
const chains = sanitizedCommand.split("&&").map((cmd) => cmd.trim());
const isSafeChain = chains.slice(1).every((cmd) =>
cmd.startsWith("docker compose ") || cmd.startsWith("docker-compose ")
);
if (!isSafeChain) {
throw new Error("Chained commands must strictly start with 'docker compose '");
}
}
const parts = sanitizedCommand.split(/\s+/);
const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1")); const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1"));
return restCommand.join(" "); return restCommand.join(" ");