Deployment
-Deployment
+
-
Deployment is
-
- {{--
- {{ Str::headline(data_get($this->application_deployment_queue, 'status')) }}.
-
- Logs will be updated automatically.
--}}
- @else
- Deployment is {{ Str::headline(data_get($application_deployment_queue, 'status')) }}.
-
- @endif
-
-
-
-
\ No newline at end of file
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index bc4eff557..bc95d5b97 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -1,8 +1,13 @@
-
-
-
-
-
-
+
+Deployment is
+
-
-
+ {{ Str::headline(data_get($this->application_deployment_queue, 'status')) }}.
+
- @forelse ($this->logLines as $line)
-
- isset($line['command']) && $line['command'],
- 'flex gap-2 dark:hover:bg-coolgray-500 hover:bg-gray-100',
- ])>
- {{ $line['timestamp'] }}
- $line['hidden'],
- 'text-red-500' => $line['stderr'],
- 'font-bold' => isset($line['command']) && $line['command'],
- 'whitespace-pre-wrap',
- ])>{!! (isset($line['command']) && $line['command'] ? '[CMD]: ' : '') . trim($line['line']) !!}
+ {{--
- Logs will be updated automatically.
--}}
+ @else
+ Deployment is {{ Str::headline(data_get($application_deployment_queue, 'status')) }}.
+
+ @endif
+
+
+
+
+
+
+
+
- @empty
- No logs yet.
- @endforelse
+
+
+
+
+
+
+
+
+
+
+
-
+
{
- const screen = document.getElementById('screen');
- const logs = document.getElementById('logs');
- if (screen.scrollTop !== logs.scrollHeight) {
- screen.scrollTop = logs.scrollHeight;
+ const logsContainer = document.getElementById('logsContainer');
+ if (logsContainer) {
+ this.isScrolling = true;
+ logsContainer.scrollTop = logsContainer.scrollHeight;
+ setTimeout(() => { this.isScrolling = false; }, 50);
}
}, 100);
} else {
@@ -26,14 +32,119 @@
this.intervalId = null;
}
},
- goTop() {
- this.alwaysScroll = false;
- clearInterval(this.intervalId);
- const screen = document.getElementById('screen');
- screen.scrollTop = 0;
+ handleScroll(event) {
+ if (!this.alwaysScroll || this.isScrolling) return;
+ const el = event.target;
+ // Check if user scrolled away from the bottom
+ const distanceFromBottom = el.scrollHeight - el.scrollTop - el.clientHeight;
+ if (distanceFromBottom > 50) {
+ this.alwaysScroll = false;
+ clearInterval(this.intervalId);
+ this.intervalId = null;
+ }
+ },
+ matchesSearch(line) {
+ if (!this.searchQuery.trim()) return true;
+ return line.toLowerCase().includes(this.searchQuery.toLowerCase());
+ },
+ decodeHtml(text) {
+ // Decode HTML entities, handling double-encoding with max iteration limit to prevent DoS
+ let decoded = text;
+ let prev = '';
+ let iterations = 0;
+ const maxIterations = 3; // Prevent DoS from deeply nested HTML entities
+
+ while (decoded !== prev && iterations < maxIterations) {
+ prev = decoded;
+ const doc = new DOMParser().parseFromString(decoded, 'text/html');
+ decoded = doc.documentElement.textContent;
+ iterations++;
+ }
+ return decoded;
+ },
+ renderHighlightedLog(el, text) {
+ const decoded = this.decodeHtml(text);
+ el.textContent = '';
+
+ if (!this.searchQuery.trim()) {
+ el.textContent = decoded;
+ return;
+ }
+
+ const query = this.searchQuery.toLowerCase();
+ const lowerText = decoded.toLowerCase();
+ let lastIndex = 0;
+
+ let index = lowerText.indexOf(query, lastIndex);
+ while (index !== -1) {
+ // Add text before match
+ if (index > lastIndex) {
+ el.appendChild(document.createTextNode(decoded.substring(lastIndex, index)));
+ }
+ // Add highlighted match
+ const mark = document.createElement('span');
+ mark.className = 'log-highlight';
+ mark.textContent = decoded.substring(index, index + this.searchQuery.length);
+ el.appendChild(mark);
+
+ lastIndex = index + this.searchQuery.length;
+ index = lowerText.indexOf(query, lastIndex);
+ }
+
+ // Add remaining text
+ if (lastIndex < decoded.length) {
+ el.appendChild(document.createTextNode(decoded.substring(lastIndex)));
+ }
+ },
+ getMatchCount() {
+ if (!this.searchQuery.trim()) return 0;
+ const logs = document.getElementById('logs');
+ if (!logs) return 0;
+ const lines = logs.querySelectorAll('[data-log-line]');
+ let count = 0;
+ lines.forEach(line => {
+ if (line.textContent.toLowerCase().includes(this.searchQuery.toLowerCase())) {
+ count++;
+ }
+ });
+ return count;
+ },
+ downloadLogs() {
+ const logs = document.getElementById('logs');
+ if (!logs) return;
+ const visibleLines = logs.querySelectorAll('[data-log-line]:not(.hidden)');
+ let content = '';
+ visibleLines.forEach(line => {
+ const text = line.textContent.replace(/\s+/g, ' ').trim();
+ if (text) {
+ content += text + String.fromCharCode(10);
+ }
+ });
+ const blob = new Blob([content], { type: 'text/plain' });
+ const url = URL.createObjectURL(blob);
+ const a = document.createElement('a');
+ a.href = url;
+ const timestamp = new Date().toISOString().slice(0,19).replace(/[T:]/g, '-');
+ a.download = this.containerName + '-logs-' + timestamp + '.txt';
+ a.click();
+ URL.revokeObjectURL(url);
+ },
+ init() {
+ if (this.expanded) { this.$wire.getLogs(); }
+ // Re-render logs after Livewire updates
+ Livewire.hook('commit', ({ succeed }) => {
+ succeed(() => {
+ this.$nextTick(() => { this.renderTrigger++; });
+ });
+ });
}
}">
-
+
+
@if ($displayName)
-
- {{ $displayName }}
@elseif ($resource?->type() === 'application' || str($resource?->type())->startsWith('standalone')) @@ -48,26 +159,90 @@
-
-
-
\ No newline at end of file
diff --git a/resources/views/livewire/project/shared/logs.blade.php b/resources/views/livewire/project/shared/logs.blade.php
index 87bb1a6b6..3a1afaa1c 100644
--- a/resources/views/livewire/project/shared/logs.blade.php
+++ b/resources/views/livewire/project/shared/logs.blade.php
@@ -17,13 +17,17 @@
-
+
@forelse ($servers as $server)
- test
';
+ $escaped = htmlspecialchars($maliciousLog);
+
+ expect($escaped)->toContain('<div');
+ expect($escaped)->toContain('style');
+ expect($escaped)->not->toContain('Server: {{ $server->name }}
+Server: {{ $server->name }}
@if ($server->isFunctional()) @if (isset($serverContainers[$server->id]) && count($serverContainers[$server->id]) > 0) + @php + $totalContainers = collect($serverContainers)->flatten(1)->count(); + @endphp @foreach ($serverContainers[$server->id] as $container)No containers are running on server: {{ $server->name }}
@@ -53,7 +57,8 @@
@forelse ($containers as $container)
@if (data_get($servers, '0'))
No functional server found for the database.
@endif
@@ -77,7 +82,8 @@
@forelse ($containers as $container)
@if (data_get($servers, '0'))
No functional server found for the service.
@endif
diff --git a/tests/Unit/LogViewerXssSecurityTest.php b/tests/Unit/LogViewerXssSecurityTest.php
new file mode 100644
index 000000000..98c5df3f1
--- /dev/null
+++ b/tests/Unit/LogViewerXssSecurityTest.php
@@ -0,0 +1,427 @@
+alert("XSS")';
+ $escaped = htmlspecialchars($maliciousLog);
+
+ expect($escaped)->toContain('<script>');
+ expect($escaped)->not->toContain('">';
+ $escaped = htmlspecialchars($maliciousLog);
+
+ expect($escaped)->toContain('<iframe');
+ expect($escaped)->toContain('data:');
+ expect($escaped)->not->toContain('test
';
+ $escaped = htmlspecialchars($maliciousLog);
+
+ expect($escaped)->toContain('<div');
+ expect($escaped)->toContain('x-html');
+ expect($escaped)->not->toContain('toBe('<>&"'');
+ });
+
+ it('preserves legitimate text content', function () {
+ $legitimateLog = 'INFO: Application started successfully';
+ $escaped = htmlspecialchars($legitimateLog);
+
+ expect($escaped)->toBe($legitimateLog);
+ });
+
+ it('handles ANSI color codes after escaping', function () {
+ $logWithAnsi = "\e[31mERROR:\e[0m Something went wrong";
+ $escaped = htmlspecialchars($logWithAnsi);
+
+ // ANSI codes should be preserved in escaped form
+ expect($escaped)->toContain('ERROR');
+ expect($escaped)->toContain('Something went wrong');
+ });
+
+ it('escapes complex nested HTML structures', function () {
+ $maliciousLog = '
';
+ $escaped = htmlspecialchars($maliciousLog);
+
+ expect($escaped)->toContain('<div');
+ expect($escaped)->toContain('<img');
+ expect($escaped)->toContain('<script>');
+ expect($escaped)->not->toContain('not->toContain('not->toContain('';
+ $escaped = htmlspecialchars($contentWithHtml);
+
+ // When stored in data attribute and rendered with x-text:
+ // 1. Server escapes to: <script>alert("XSS")</script>
+ // 2. Browser decodes the attribute value to:
+ // 3. x-text renders it as textContent (plain text), NOT innerHTML
+ // 4. Result: User sees "" as text, script never executes
+
+ expect($escaped)->toContain('<script>');
+ expect($escaped)->not->toContain('';
+
+ // Step 1: Server-side escaping (PHP)
+ $escaped = htmlspecialchars($rawLog);
+ expect($escaped)->toBe('<script>alert("XSS")</script>');
+
+ // Step 2: Stored in data-log-content attribute
+ //
+
+ // Step 3: Client-side getDisplayText() decodes HTML entities
+ // const decoded = doc.documentElement.textContent;
+ // Result: '' (as text string)
+
+ // Step 4: x-text renders as textContent (NOT innerHTML)
+ // Alpine.js sets element.textContent = decoded
+ // Result: Browser displays '' as visible text
+ // The script tag is never parsed or executed - it's just text
+
+ // Step 5: Highlighting via CSS class
+ // If search query matches, 'log-highlight' class is added
+ // Visual feedback is provided through CSS, not HTML injection
+ });
+
+ it('documents search highlighting with CSS classes', function () {
+ $legitimateLog = '2024-01-01T12:00:00.000Z ERROR: Database connection failed';
+
+ // Server-side: Escape and store
+ $escaped = htmlspecialchars($legitimateLog);
+ expect($escaped)->toBe($legitimateLog); // No special chars
+
+ // Client-side: If user searches for "ERROR"
+ // 1. splitTextForHighlight() divides the text into parts:
+ // - Part 1: "2024-01-01T12:00:00.000Z " (highlight: false)
+ // - Part 2: "ERROR" (highlight: true) <- This part gets highlighted
+ // - Part 3: ": Database connection failed" (highlight: false)
+ // 2. Each part is rendered as a with x-text (safe)
+ // 3. Only Part 2 gets the 'log-highlight' class via :class binding
+ // 4. CSS provides yellow/warning background color on "ERROR" only
+ // 5. No HTML injection occurs - just multiple safe text spans
+
+ expect($legitimateLog)->toContain('ERROR');
+ });
+
+ it('verifies no HTML injection occurs during search', function () {
+ $logWithHtml = 'User input: ';
+ $escaped = htmlspecialchars($logWithHtml);
+
+ // Even if log contains malicious HTML:
+ // 1. Server escapes it
+ // 2. x-text renders as plain text
+ // 3. Search highlighting uses CSS class, not HTML tags
+ // 4. User sees the literal text with highlight background
+ // 5. No script execution possible
+
+ expect($escaped)->toContain('<img');
+ expect($escaped)->toContain('onerror');
+ expect($escaped)->not->toContain('![]();
+ });
+
+ it()
toContain('