andwati/dokploy
1
0
Fork 0
mirror of https://github.com/andwati/dokploy.git synced 2026-10-21 04:24:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): validate volumeName and escape volume-backup file names

Browse Source 
Add VOLUME_NAME_REGEX (Docker volume-name format) and enforce it on volumeName in
create/update/runManually — a legit volume name never contains shell metacharacters,
so this blocks injection across every docker run/rm/rclone sink at once. Escape the
user-supplied backupFileName and the mount volumeName in database rebuild with quote().
This commit is contained in:
Mauricio Siu
2026-07-20 16:45:55 -06:00
parent eeb6e7b8ea
commit d629faebc6
5 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/utils/databases/rebuild.ts
+2 -1
View File
@@ -14,6 +14,7 @@ import { deployMySql } from "@dokploy/server/services/mysql";
import { deployPostgres } from "@dokploy/server/services/postgres";
import { deployRedis } from "@dokploy/server/services/redis";
import { eq } from "drizzle-orm";
import { quote } from "shell-quote";
import { removeService } from "../docker/utils";
import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -40,7 +41,7 @@ export const rebuildDatabase = async (
for (const mount of database.mounts) {
if (mount.type === "volume") {
const command = `docker volume rm ${mount?.volumeName} --force`;
const command = `docker volume rm ${quote([mount?.volumeName ?? ""])} --force`;
if (database.serverId) {
await execAsyncRemote(database.serverId, command);
} else {
packages/server/src/utils/volume-backups/restore.ts
+3 -2
View File
@@ -1,4 +1,5 @@
import path from "node:path";
import { quote } from "shell-quote";
import {
findApplicationById,
findComposeById,
@@ -23,7 +24,7 @@ export const restoreVolume = async (
const backupPath = `${bucketPath}/${backupFileName}`;
// Command to download backup file from S3
const downloadCommand = `rclone copyto ${rcloneFlags.join(" ")} "${backupPath}" "${volumeBackupPath}/${backupFileName}"`;
const downloadCommand = `rclone copyto ${rcloneFlags.join(" ")} ${quote([backupPath])} ${quote([`${volumeBackupPath}/${backupFileName}`])}`;
// Base restore command that creates the volume and restores data
const baseRestoreCommand = `
@@ -40,7 +41,7 @@ export const restoreVolume = async (
-v ${volumeName}:/volume_data \
-v ${volumeBackupPath}:/backup \
ubuntu \
bash -c "cd /volume_data && tar xvf /backup/${backupFileName} ."
bash -c "cd /volume_data && tar xvf /backup/${quote([backupFileName])} ."
echo "Volume restore completed ✅"
`;