rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(validation): allow quoted docker run options in custom config (#9481)

Browse source
This commit is contained in:
Andras Bacsai 2026-04-08 14:23:18 +02:00 committed by GitHub
commit e4d293cb9a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 66 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/Support/ValidationPatterns.php
View file

@ -40,10 +40,11 @@ class ValidationPatterns
* Blocks dangerous shell metacharacters: ; | ` $ ( ) > < newlines and carriage returns * Blocks dangerous shell metacharacters: ; | ` $ ( ) > < newlines and carriage returns
* Allows & for command chaining (&&) which is common in multi-step build commands * Allows & for command chaining (&&) which is common in multi-step build commands
* Allows double quotes for build args with spaces (e.g. --build-arg KEY="value") * Allows double quotes for build args with spaces (e.g. --build-arg KEY="value")
* Blocks backslashes and single quotes to prevent escape-sequence attacks * Blocks backslashes to prevent escape-sequence attacks
* Allows single and double quotes for quoted arguments (e.g. --entrypoint "sh -c 'npm start'")
* Uses [ \t] instead of \s to explicitly exclude \n and \r (which act as command separators) * Uses [ \t] instead of \s to explicitly exclude \n and \r (which act as command separators)
*/ */
public const SHELL_SAFE_COMMAND_PATTERN = '/^[a-zA-Z0-9 \t._\-\/=:@,+\[\]{}#%^~&"]+$/'; public const SHELL_SAFE_COMMAND_PATTERN = '/^[a-zA-Z0-9 \t._\-\/=:@,+\[\]{}#%^~&"\']+$/';
/** /**
* Pattern for Docker volume names * Pattern for Docker volume names

45
templates/service-templates-latest.json
View file

File diff suppressed because one or more lines are too long

45
templates/service-templates.json
View file

File diff suppressed because one or more lines are too long

3
tests/Feature/CommandInjectionSecurityTest.php
View file

@ -512,6 +512,9 @@
'--cap-add=NET_ADMIN --cap-add=NET_RAW', '--cap-add=NET_ADMIN --cap-add=NET_RAW',
'--privileged --init', '--privileged --init',
'--memory=512m --cpus=2', '--memory=512m --cpus=2',
'--entrypoint "sh -c \'npm start\'"',
'--entrypoint "sh -c \'php artisan schedule:work\'"',
'--hostname "my-host"',
]); ]);
}); });