mirror of
https://github.com/andwati/dokploy.git
synced 2026-10-25 22:42:18 +00:00
- dockerImage (buildRemoteDocker) -> docker pull / echo - dockerContextPath (docker-file builder) -> cd - publishDirectory (nixpacks builder) -> docker cp source/dest paths These fields were interpolated unescaped into shell commands run via execAsync / execAsyncRemote during deployment. All are now passed through shell-quote. Registry credentials already went through safeDockerLoginCommand (unchanged). Closes GHSA-g9cg-4mmj-mh7p, GHSA-jxxj-gmpx-h5rj, GHSA-qjrc-g63x-qhp9, GHSA-98j8-6vjr-c3xw
38 lines
843 B
TypeScript
38 lines
843 B
TypeScript
import { safeDockerLoginCommand } from "@dokploy/server/services/registry";
|
|
import { quote } from "shell-quote";
|
|
import type { ApplicationNested } from "../builders";
|
|
|
|
export const buildRemoteDocker = async (application: ApplicationNested) => {
|
|
const { registryUrl, dockerImage, username, password } = application;
|
|
|
|
try {
|
|
if (!dockerImage) {
|
|
throw new Error("Docker image not found");
|
|
}
|
|
let command = `
|
|
echo ${quote([`Pulling ${dockerImage}`])};
|
|
`;
|
|
|
|
if (username && password) {
|
|
command += `
|
|
if ! ${safeDockerLoginCommand(registryUrl || "", username, password)} 2>&1; then
|
|
echo "❌ Login failed";
|
|
exit 1;
|
|
fi
|
|
`;
|
|
}
|
|
|
|
command += `
|
|
docker pull ${quote([dockerImage])} 2>&1 || {
|
|
echo "❌ Pulling image failed";
|
|
exit 1;
|
|
}
|
|
|
|
echo "✅ Pulling image completed.";
|
|
`;
|
|
return command;
|
|
} catch (error) {
|
|
throw error;
|
|
}
|
|
};
|